Probleme avec win 7 home security 2011

Salut,

oui,

Télécharge ça : https://www.luanagames.com/index.fr.html
Tu le renommes en winlogon ou iexplore s'il est bloqué.
Lances en option 2 (nettoyage).
Poste le rapport ici.

voici le rapport
RogueKiller V5.1.9 [29/05/2011] par Tigzy
contact sur http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html

Systeme d'exploitation: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode normal
Utilisateur: receveau [Droits d'admin]
Mode: Suppression -- Date : 31/05/2011 10:20:21

Processus malicieux: 1
[SUSP PATH] omm.exe -- c:\users\receveau\appdata\local\omm.exe -> KILLED

Entrees de registre: 6
[SUSP PATH] HKLM\[...]\Run : Setwallpaper (c:\programdata\SetWallpaper.cmd) -> DELETED
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[FILE ASSO] HKCU\[...]Software\Classes\.exe\shell\open\command : ("C:\Users\receveau\AppData\Local\omm.exe" -a "%1" %*) -> REPLACED : ("%1" %*)
[FILE ASSO] HKCU\[...]Software\Classes\exefile\shell\open\command : ("C:\Users\receveau\AppData\Local\omm.exe" -a "%1" %*) -> REPLACED : ("%1" %*)
[FILE ASSO] HKLM\[...]Software\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command : ("C:\Users\receveau\AppData\Local\omm.exe" -a "C:\Program Files (x86)\Int") -> REPLACED : ("C:\Program Files (x86)\internet explorer\iexplore.exe")

Fichier HOSTS:

Termine : << RKreport[1].txt >>
RKreport[1].txt

Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Mets le à jour, fais un scan rapide, supprime tout et poste le rapport ici.
!!! Malwarebyte doit être à jour avant de faire le scan !!!

Ensuite :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

* Lance OTL
* Sous Peronnalisation, copie-colle ce qu'il y a dans le cadre ci-dessous :
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%temp%\*.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
CREATERESTOREPOINT
nslookup www.google.fr /c
SAVEMBR:0
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
* Clique sur le bouton Analyse.
* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer les rapports.
Donnes le liens pjjoint ici ensuite pour pouvoir être consultés.

ok merci

Ca y est scan fini avec MalwareBytes, ci-joint le rapport :
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Version de la base de données: 6729

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

31/05/2011 10:50:22
mbam-log-2011-05-31 (10-50-22).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 159623
Temps écoulé: 3 minute(s), 54 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Users\receveau\local settings\application data\llw.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.
c:\Users\receveau\local settings\application data\omm.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.

-----je continue les autres manip

ca y est scan fini voici le lien

http://pjjoint.malekal.com/files.php?id=725b490ae17127

Relance OTL.
o sous Personnalisation, copie_colle le contenu du cadre ci dessous et clic Correction, un rapport apparraitra suite à l'operation que tu conserveras sur clé usb par exemple afin d'en coller le resultat:

:OTL
[2011/05/31 10:16:47 | 000,010,862 | -HS- | M] () -- C:\Users\receveau\AppData\Local\q7r4272d5q74woje5dl15nw1457
[2011/05/31 09:56:02 | 000,010,850 | -HS- | M] () -- C:\ProgramData\q7r4272d5q74woje5dl15nw1457
[2011/05/28 14:37:30 | 000,000,000 | ---- | M] () -- C:\Users\receveau\AppData\Roaming\9716558.exe
[2011/05/28 14:37:30 | 000,000,000 | ---- | M] () -- C:\Users\receveau\AppData\Roaming\6113666.exe
[2011/05/28 14:37:30 | 000,000,000 | ---- | M] () -- C:\Users\receveau\AppData\Roaming\5323866.exe
[2011/05/28 14:37:30 | 000,000,000 | ---- | M] () -- C:\Users\receveau\AppData\Roaming\3443377.exe
[2011/05/28 14:37:29 | 000,327,680 | ---- | M] () -- C:\Users\receveau\AppData\Roaming\6646357.exe

* redemarre le pc sous windows et poste le rapport ici

Je ne peux plus relancer OTL, après une mise à jour j'ai éteint l'ordi, j'ai le message demarage window et puis après ecran noir. La souris est libre mais je n'ai plus accès à rien.
gros problème

Tu peux démarrer en dernière bonne configuration connue ?

non il ne me le propose pas, j'ai essayé en mode sans échec mais il prend pas non plus

OK :/

Grave le CD OTLPE : https://forum.malekal.com/viewtopic.php?t=23453&start=
Démarres le PC sur ce CD.

Si tu as internet, scanne le fichier C:\Windows\SysNative\drivers\Volsnap.sys sur https://www.virustotal.com/gui/ et donne le lien ici.

Si tu as pas internet, transfère Volsnap.sys sur un autre PC et scanne le sur virustotal depuis ce PC.

oui je me connecte sur internet via un autre pc. je suis en train de telecharger otlpe live et je te transmettrais le fichier dès que je pourrais y avoir acces

voici le rapport
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community
user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
volsnap.sys
2011-05-31 13:41:59 (UTC)
finished
0/ 42 (0.0%)
VT Community
not reviewed
Safety score: -
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.05.31.03 2011.05.31 -
AntiVir 7.11.8.208 2011.05.31 -
Antiy-AVL 2.0.3.7 2011.05.31 -
Avast 4.8.1351.0 2011.05.31 -
Avast5 5.0.677.0 2011.05.31 -
AVG 10.0.0.1190 2011.05.31 -
BitDefender 7.2 2011.05.31 -
CAT-QuickHeal 11.00 2011.05.31 -
ClamAV 0.97.0.0 2011.05.31 -
Commtouch 5.3.2.6 2011.05.31 -
Comodo 8904 2011.05.31 -
DrWeb 5.0.2.03300 2011.05.31 -
eSafe 7.0.17.0 2011.05.26 -
eTrust-Vet 36.1.8358 2011.05.31 -
F-Prot 4.6.2.117 2011.05.30 -
F-Secure 9.0.16440.0 2011.05.31 -
Fortinet 4.2.257.0 2011.05.31 -
GData 22 2011.05.31 -
Ikarus T3.1.1.104.0 2011.05.31 -
Jiangmin 13.0.900 2011.05.30 -
K7AntiVirus 9.104.4740 2011.05.30 -
Kaspersky 9.0.0.837 2011.05.31 -
McAfee 5.400.0.1158 2011.05.31 -
McAfee-GW-Edition 2010.1D 2011.05.31 -
Microsoft 1.6903 2011.05.31 -
NOD32 6168 2011.05.31 -
Norman 6.07.07 2011.05.30 -
nProtect 2011-05-31.02 2011.05.31 -
Panda 10.0.3.5 2011.05.31 -
PCTools 7.0.3.5 2011.05.19 -
Prevx 3.0 2011.05.31 -
Compact
VirusTotal - Free Online Virus, Malware and URL Scanner http://www.virustotal.com/file-scan/report.html?id=3d6716cec95b886...
1 sur 3 31/05/2011 15:42
Additional information Show all
Goodware Malware Spam attachment/link
P2P download Propagating via IM Network worm
Drive-by-download
Preview comment Post comment
Rising 23.60.01.05 2011.05.31 -
Sophos 4.65.0 2011.05.31 -
SUPERAntiSpyware 4.40.0.1006 2011.05.31 -
Symantec 20111.1.0.186 2011.05.31 -
TheHacker 6.7.0.1.215 2011.05.31 -
TrendMicro 9.200.0.1012 2011.05.31 -
TrendMicro-HouseCall 9.200.0.1012 2011.05.31 -
VBA32 3.12.16.0 2011.05.31 -
VIPRE 9443 2011.05.31 -
ViRobot 2011.5.31.4488 2011.05.31 -
VirusBuster 14.0.58.0 2011.05.31 -
MD5 : 0d08d2f3b3ff84e433346669b5e0f639
SHA1 : 1a141dbfa4083406630dd9a81ad35c416f604800
SHA256: 3d6716cec95b8861a7cc5778e91f310528dc6bee0e57a3c8757fc675154ebdec
VT Community

ha..
Je m'attendais à ce qu'il soit pourri.

Tu peux transférer tous les fichiers .sys de drivers et les scanner sur ton PC avec ton antivirus voir ce qu'il dit ?
Tu peux mettre le zip sur http://upload.malekal.com stp.

Yes, no, maybe
I don't know
Can you repeat the question?
You're not the boss of me now

ok sur mon pc j'ai antivir, ça ira

voici ce que cela donne

Avira AntiVir Personal
Report file date: mardi 31 mai 2011 16:14

Scanning for 2772256 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : michel
Computer name :

Version information:
BUILD.DAT : 10.0.0.648 31823 Bytes 01/04/2011 18:36:00
AVSCAN.EXE : 10.0.4.2 442024 Bytes 29/04/2011 10:48:57
AVSCAN.DLL : 10.0.3.0 46440 Bytes 01/04/2010 10:57:04
LUKE.DLL : 10.0.3.2 104296 Bytes 20/12/2010 11:14:48
LUKERES.DLL : 10.0.0.1 12648 Bytes 10/02/2010 21:40:48
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 07:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14/12/2010 12:37:06
VBASE002.VDF : 7.11.3.0 1950720 Bytes 09/02/2011 12:37:08
VBASE003.VDF : 7.11.5.225 1980416 Bytes 07/04/2011 19:39:05
VBASE004.VDF : 7.11.5.226 2048 Bytes 07/04/2011 19:39:06
VBASE005.VDF : 7.11.5.227 2048 Bytes 07/04/2011 19:39:06
VBASE006.VDF : 7.11.5.228 2048 Bytes 07/04/2011 19:39:07
VBASE007.VDF : 7.11.5.229 2048 Bytes 07/04/2011 19:39:07
VBASE008.VDF : 7.11.5.230 2048 Bytes 07/04/2011 19:39:07
VBASE009.VDF : 7.11.5.231 2048 Bytes 07/04/2011 19:39:08
VBASE010.VDF : 7.11.5.232 2048 Bytes 07/04/2011 19:39:08
VBASE011.VDF : 7.11.5.233 2048 Bytes 07/04/2011 19:39:08
VBASE012.VDF : 7.11.5.234 2048 Bytes 07/04/2011 19:39:08
VBASE013.VDF : 7.11.6.28 158208 Bytes 11/04/2011 19:39:10
VBASE014.VDF : 7.11.6.74 116224 Bytes 13/04/2011 19:39:11
VBASE015.VDF : 7.11.6.113 137728 Bytes 14/04/2011 19:39:13
VBASE016.VDF : 7.11.6.150 146944 Bytes 18/04/2011 19:40:02
VBASE017.VDF : 7.11.6.192 138240 Bytes 20/04/2011 19:40:02
VBASE018.VDF : 7.11.6.237 156160 Bytes 22/04/2011 11:56:29
VBASE019.VDF : 7.11.7.45 427520 Bytes 27/04/2011 10:48:56
VBASE020.VDF : 7.11.7.64 192000 Bytes 28/04/2011 10:48:56
VBASE021.VDF : 7.11.7.97 182272 Bytes 02/05/2011 10:47:52
VBASE022.VDF : 7.11.7.127 467968 Bytes 04/05/2011 10:53:03
VBASE023.VDF : 7.11.7.183 185856 Bytes 09/05/2011 11:06:59
VBASE024.VDF : 7.11.7.218 133120 Bytes 11/05/2011 12:32:50
VBASE025.VDF : 7.11.7.234 139776 Bytes 11/05/2011 12:32:51
VBASE026.VDF : 7.11.8.16 147456 Bytes 13/05/2011 18:17:04
VBASE027.VDF : 7.11.8.46 169472 Bytes 17/05/2011 19:15:27
VBASE028.VDF : 7.11.8.109 181760 Bytes 24/05/2011 10:39:14
VBASE029.VDF : 7.11.8.158 191488 Bytes 27/05/2011 19:53:43
VBASE030.VDF : 7.11.8.159 2048 Bytes 27/05/2011 19:53:43
VBASE031.VDF : 7.11.8.162 24576 Bytes 29/05/2011 19:53:43
Engineversion : 8.2.5.6
AEVDF.DLL : 8.1.2.1 106868 Bytes 31/07/2010 08:03:46
AESCRIPT.DLL : 8.1.3.65 1606010 Bytes 29/05/2011 19:54:11
AESCN.DLL : 8.1.7.2 127349 Bytes 23/11/2010 11:57:23
AESBX.DLL : 8.2.1.33 323956 Bytes 26/05/2011 10:39:19
AERDL.DLL : 8.1.9.9 639347 Bytes 14/04/2011 19:39:29
AEPACK.DLL : 8.2.6.8 557430 Bytes 18/05/2011 19:16:16
AEOFFICE.DLL : 8.1.1.23 205178 Bytes 29/05/2011 19:54:02
AEHEUR.DLL : 8.1.2.122 3494263 Bytes 29/05/2011 19:54:00
AEHELP.DLL : 8.1.17.2 246135 Bytes 22/05/2011 12:04:03
AEGEN.DLL : 8.1.5.6 401780 Bytes 22/05/2011 12:04:02
AEEMU.DLL : 8.1.3.0 393589 Bytes 23/11/2010 11:57:14
AECORE.DLL : 8.1.21.1 196983 Bytes 26/05/2011 10:39:15
AEBB.DLL : 8.1.1.0 53618 Bytes 23/04/2010 19:05:40
AVWINLL.DLL : 10.0.0.0 19304 Bytes 04/03/2011 12:36:52
AVPREF.DLL : 10.0.0.0 44904 Bytes 04/03/2011 12:36:52
AVREP.DLL : 10.0.0.10 174120 Bytes 18/05/2011 19:16:22
AVREG.DLL : 10.0.3.2 53096 Bytes 17/08/2010 12:38:56
AVSCPLR.DLL : 10.0.4.2 84840 Bytes 29/04/2011 10:48:57
AVARKT.DLL : 10.0.22.6 231784 Bytes 20/12/2010 11:14:43
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 04/03/2011 12:36:50
SQLITE3.DLL : 3.6.19.0 355688 Bytes 17/06/2010 14:28:02
AVSMTP.DLL : 10.0.0.17 63848 Bytes 17/08/2010 12:38:56
NETNT.DLL : 10.0.0.0 11624 Bytes 17/06/2010 14:28:01
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 04/03/2011 12:37:12
RCTEXT.DLL : 10.0.58.0 97128 Bytes 04/03/2011 12:37:12

Configuration settings for the scan:
Jobname.............................: Sélection manuelle
Configuration file..................: C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira\AntiVir Desktop\PROFILES\folder.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: F:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: Intelligent file selection
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +PCK,

Start of the scan: mardi 31 mai 2011 16:14

Starting search for hidden objects.
c:\windows\system32\ntmsdata\ntmsjrnl
c:\windows\system32\ntmsdata\ntmsjrnl
[NOTE] The file is not visible.

The scan of running processes will be started
Scan process 'rsmsink.exe' - '1' Module(s) have been scanned
Scan process 'msdtc.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'vssvc.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'AcroRd32.exe' - '1' Module(s) have been scanned
Scan process 'plugin-container.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'SearchSettings.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'RunDll32.exe' - '1' Module(s) have been scanned
Scan process 'Explorer.EXE' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned
Scan process 'LVComSer.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'CDANTSRV.EXE' - '1' Module(s) have been scanned
Scan process 'avshadow.exe' - '1' Module(s) have been scanned
Scan process 'ApplicationUpdater.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!
Master boot sector HD5
[INFO] No virus was found!
Master boot sector HD6
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'F:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '581' files ).

Starting the file scan:

Begin scan in 'F:\'

End of the scan: mardi 31 mai 2011 16:34
Used time: 19:23 Minute(s)

The scan has been done completely.

2 Scanned directories
918 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
918 Files not concerned
0 Archives were scanned
0 Warnings
1 Notes
82122 Objects were scanned with rootkit scan
1 Hidden objects were found

Envoie le zip des fichiers .sys sur http://upload.malekal.com stp.

ok

j essaie de l envoyer en 7z mais il part pas (vous n'avez pas choisi de fichier, alors qu'il est bien sélectionné). il faut un .zip absolument

je n'arrive pas à le transmettre, même en zip il ne part pas