trojan system 32 faire rapport hitjackthis ?

Question

Bonsoir à vous je viens de faire un scan online bitdefender qui m'a trouvé un trojan dans system 32 et je voudrais effectuer un rapport hitjackthis pourriez vous m'aidez à supprimé les lignes défectueuse. j'ai lancé ewido cleanup ccleaner spyboat est ce suffisant merci à bientot.

Utilisateur anonyme · Answer

Salut,Télécharge HijackThis: Téléchargement de HijackThisInstalle le dans son propre dossier:-clic droit sur le bureau, choisis "nouveau dossier" puis installe le dedans.Lance le, clic sur "do a system scan and save logfile" Puis copie et colle le rapport ici stp

phk30 · Answer

Logfile of HijackThis v1.99.1Scan saved at 01:10:02, on 20/09/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeC:\Program Files\F-Secure\Anti-Virus\FSGK32.EXEC:\Program Files\F-Secure\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\system32\oodag.exeC:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\F-Secure\Common\FSMA32.EXEC:\Program Files\F-Secure\Common\FSMB32.EXEC:\Program Files\F-Secure\Common\FCH32.EXEC:\Program Files\F-Secure\Common\FAMEH32.EXEC:\Program Files\F-Secure\Common\FNRB32.EXEC:\Program Files\F-Secure\Common\FIH32.EXEC:\Program Files\F-Secure\Anti-Virus\fsav32.exeC:\WINDOWS\system32\WgaTray.exeC:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exeC:\Program Files\F-Secure\Common\FSM32.EXEC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\SlySoft\AnyDVD\AnyDVD.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Documents and Settings\richard_2\Mes documents\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO2 - BHO: (no name) - {DCBC412F-DBD7-4F75-B201-07F06C7843D5} - (no file)O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dllO3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htmO8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2e3e6af8f1de44fbaa285ba52558494bO8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2e3e6af8f1de44fbaa285ba52558494bO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_sit...O17 - HKLM\System\CS1\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXEO23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXEO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXEO23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exebonsoir voilà le rapport, bitdefender vient d'enlever un trojan downloader agent rg, merci à bientot

phk30 · Answer

bonjour merci, le lien c'est pour installer kerio est ce un bon parefeu ? merci à bientot

Utilisateur anonyme · Answer

non, ce n'est pas pour installer Kerio ..mais un clic dessus tu y aurai vu plus clair :-/

phk30 · Answer

Logfile of HijackThis v1.99.1Scan saved at 21:42:43, on 21/09/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Documents and Settings\richard_2\Mes documents\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.wanadoo.frR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO2 - BHO: (no name) - {DCBC412F-DBD7-4F75-B201-07F06C7843D5} - (no file)O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dllO3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htmO8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2e3e6af8f1de44fbaa285ba52558494bO8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2e3e6af8f1de44fbaa285ba52558494bO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - www.mypixmania.com/fr/fr/importer/MypixUploader.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -  update.microsoft.comO17 - HKLM\System\CS1\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CS2\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.1 80.10.246.132O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXEO23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXEO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXEO23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exebonsoir c'est encore moi mais mon pc est très lent pourquoi? sèb 08 avez vous vu quelque chose car aujourd'hui c'est très difficile de travaillé il est très lent  l'hitjack aété fais en mode sans echec merci à bientot.

phk30 · Answer

bonsoir merci d'être aussi rapide voici mon rapport est ce mieux comme ça, Logfile of HijackThis v1.99.1Scan saved at 22:29:47, on 21/09/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeC:\Program Files\F-Secure\Anti-Virus\FSGK32.EXEC:\Program Files\F-Secure\Anti-Virus\fssm32.exeC:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\system32\oodag.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\F-Secure\Common\FSMA32.EXEC:\Program Files\F-Secure\Common\FSMB32.EXEC:\Program Files\F-Secure\Common\FCH32.EXEC:\Program Files\F-Secure\Common\FAMEH32.EXEC:\Program Files\F-Secure\Common\FNRB32.EXEC:\Program Files\F-Secure\Anti-Virus\fsav32.exeC:\Program Files\F-Secure\Common\FIH32.EXEC:\WINDOWS\system32\WgaTray.exeC:\WINDOWS\Explorer.EXEC:\Program Files\F-Secure\Common\FSM32.EXEC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\richard_2\Mes documents\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO2 - BHO: (no name) - {DCBC412F-DBD7-4F75-B201-07F06C7843D5} - (no file)O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dllO3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htmO8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2e3e6af8f1de44fbaa285ba52558494bO8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2e3e6af8f1de44fbaa285ba52558494bO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O17 - HKLM\System\CCS\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.1 80.10.246.132O17 - HKLM\System\CS1\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CS3\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.1 80.10.246.132O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEO23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXEO23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXEO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXEO23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

phk30 · Answer

re , j'ai lancé bitdefender mais il n'y a pas eu la barre pop up active x cela fonctionne quand même, merci àbientot

phk30 · Answer

re, en fait j'avais laissé dans propriété internet entré tout les cookies, merci et je mets le rapport plus tard car bitdef  est très long bonne nuit.

Utilisateur anonyme · Answer

n'accepte que les cookies des sites visités ;-)ok, pour le rapportbonne nuit à toi

phk30 · Answer

bonjour le rapport est vierge donc je ne l'ai pas mis, pour les cookies quel le niveaux moyen haut ou alors il faut faire un réglage manuel, merci pour m'avoir aidé à supprimer toutes les choses de mon pc, à bientot.

Utilisateur anonyme · Answer

Salut,met sur "moyen" pour les cookies :-)Si tu as des problémes hésite pas A++

phk30 · Answer

BitDefender Online Scanner - Real Time Virus Report     Generated at: Sat, Sep 23, 2006 - 09:36:41 --------------------------------------------------------------------------------      Scan Info     Scanned Files 377431 Infected Files 3            Virus Detected     Application.Adware.NewDotNet.B 1 Trojan.Proxy.Horst.CG 1 Trojan.Zlob.Gen 1             --------------------------------------------------------------------------------     This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.      bonjour j'ai rattrapé des trojan hier voici lerapport bitdefender Logfile of HijackThis v1.99.1Scan saved at 09:43:39, on 23/09/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEC:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeC:\Program Files\F-Secure\Anti-Virus\FSGK32.EXEC:\Program Files\F-Secure\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\F-Secure\Common\FSMA32.EXEC:\Program Files\F-Secure\Common\FSMB32.EXEC:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exeC:\Program Files\F-Secure\Common\FCH32.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\F-Secure\Common\FNRB32.EXEC:\Program Files\F-Secure\Common\FIH32.EXEC:\WINDOWS\system32\WgaTray.exeC:\Program Files\F-Secure\Common\FSM32.EXEC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\F-Secure\Common\FAMEH32.EXEC:\Program Files\F-Secure\Anti-Virus\fsav32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\DOCUME~1\RICHAR~3\LOCALS~1\Temp\13exmodul32d.4.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\richard_2\Mes documents\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO2 - BHO: (no name) - {DCBC412F-DBD7-4F75-B201-07F06C7843D5} - (no file)O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dllO3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /wO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htmO8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2e3e6af8f1de44fbaa285ba52558494bO8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2e3e6af8f1de44fbaa285ba52558494bO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CS1\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CS3\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEO23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXEO23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXEO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXEO23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exeet htjack this merci de me dire si j'ai bien travaillé à bientot merci

phk30 · Answer

Logfile of HijackThis v1.99.1Scan saved at 10:52:16, on 23/09/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEC:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeC:\Program Files\F-Secure\Anti-Virus\FSGK32.EXEC:\Program Files\F-Secure\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\F-Secure\Common\FSMA32.EXEC:\Program Files\F-Secure\Common\FSMB32.EXEC:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exeC:\Program Files\F-Secure\Common\FCH32.EXEC:\Program Files\F-Secure\Common\FAMEH32.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\F-Secure\Common\FNRB32.EXEC:\WINDOWS\system32\WgaTray.exeC:\Program Files\F-Secure\Common\FIH32.EXEC:\Program Files\F-Secure\Anti-Virus\fsav32.exeC:\Program Files\F-Secure\Common\FSM32.EXEC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\richard_2\Mes documents\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO2 - BHO: (no name) - {DCBC412F-DBD7-4F75-B201-07F06C7843D5} - (no file)O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dllO3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htmO8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2e3e6af8f1de44fbaa285ba52558494bO8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2e3e6af8f1de44fbaa285ba52558494bO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CS1\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CS3\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXEO23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXEO23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXEO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXEO23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exeRe voici hitjack après ewido merci je crois hier j'avais attrapé un chevaux sympa merci à bientot.

Utilisateur anonyme · Answer

Salut,ton rapport me semble propre.Fait ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X; la barre anti-popup du SP2(en haut) va se mettre à clignoter, clic dessus et choisis "accepter l'active X" pour  faire fonctionner le scan anti-virus.Une fois qu'il a terminé colle le rapport ici stp_Online Scanner_Kaspersky Online Scanner_My Computerhttps://www.kaspersky.fr/downloads

phk30 · Answer

bonsoir merci et bonne nuit je poste le rapport demain soir.

Utilisateur anonyme · Answer

Salut,ok, pas de probléme, Bonne nuit à toi ;-)++

phk30 · Answer

KASPERSKY ONLINE SCANNER REPORT  Sunday, September 24, 2006 5:43:00 AMOperating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)Kaspersky Online Scanner version: 5.0.83.0Kaspersky Anti-Virus database last update: 24/09/2006Kaspersky Anti-Virus database records: 212858  Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true  Scan Target My Computer A:\C:\D:\E:\F:\G:\H:\I:\   Scan Statistics Total number of scanned objects 124252 Number of viruses found 2 Number of infected objects 3 / 0 Number of suspicious objects 0 Duration of the scan process 01:47:10 Infected Object Name Virus Name Last Action C:\bf80d5931cf68876c08269b764829550\update\update.exe  Object is locked  skipped   C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\DSS\MachineKeys\9224d8a476e4d060f25cf94c769367a5_287280f2-35d4-4f0c-a380-7d5f95f91af2  Object is locked  skipped   C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat  Object is locked  skipped   C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003
tuser.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003\NTUSER.DAT  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settingsichard_2\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settingsichard_2
tuser.dat  Object is locked  skipped   C:\Documents and Settingsichard_2
tuser.dat.LOG  Object is locked  skipped   C:\e01144c5d\update\update.exe  Object is locked  skipped   C:\fb8b5687976fd9d07e9c2418c\update\update.exe  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chn.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chn.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\D0000000.FCS  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\inuse.txt  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\L0000005.FCS  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\main.log  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_die.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_die.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_dnd.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_dnd.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_ext.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_ext.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_rcv.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_rcv.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.idx  Object is locked  skipped   C:\Program Files\F-Secure\Common\policy.ipf  Object is locked  skipped   C:\System Volume Information\MountPointManagerRemoteDatabase  Object is locked  skipped   C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP421\A0229705.exe  Infected: Trojan-Downloader.Win32.Agent.aht  skipped   C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP421\A0229729.exe  Infected: Trojan.Win32.Agent.xu  skipped   C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP421\change.log  Object is locked  skipped   C:\WINDOWS\Debug\PASSWD.LOG  Object is locked  skipped   C:\WINDOWS\SchedLgU.Txt  Object is locked  skipped   C:\WINDOWS\SoftwareDistribution\ReportingEvents.log  Object is locked  skipped   C:\WINDOWS\Sti_Trace.log  Object is locked  skipped   C:\WINDOWS\system32\CatRoot2\edb.log  Object is locked  skipped   C:\WINDOWS\system32\CatRoot2	mp.edb  Object is locked  skipped   C:\WINDOWS\system32\config\AppEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\default  Object is locked  skipped   C:\WINDOWS\system32\config\default.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SAM  Object is locked  skipped   C:\WINDOWS\system32\config\SAM.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SecEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\SECURITY  Object is locked  skipped   C:\WINDOWS\system32\config\SECURITY.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\software  Object is locked  skipped   C:\WINDOWS\system32\config\software.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SysEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\system  Object is locked  skipped   C:\WINDOWS\system32\config\system.LOG  Object is locked  skipped   C:\WINDOWS\system32\h323log.txt  Object is locked  skipped   C:\WINDOWS\system32
vsvcd.exe  Infected: Trojan.Win32.Agent.xu  skipped   C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP  Object is locked  skipped   C:\WINDOWS\wiadebug.log  Object is locked  skipped   C:\WINDOWS\wiaservc.log  Object is locked  skipped   C:\WINDOWS\WindowsUpdate.log  Object is locked  skipped   Scan process completed. bonjour voilà le rapport de kasperski mais a t'il tout supprimé merci à bientot.

Utilisateur anonyme · Answer

Salut,ceci est suspect, tu connais ?C:\e01144c5d\update\update.exe Puis pour finirAlors ceci; C:\System Volume Information\_restore(voir rapport Kaspersky) indique que ta restauration du systeme  etait infecté ou est infecté, pour être sûr, nous allons créer un point propre.Clic sur "demarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du systeme"¤ coches la case "desactiver la Restauration du systéme sur tous les lecteurs", puis clic ur "appliquer" ¤ decoches la case et clic sur "appliquer" puis "ok".Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre:Clic sur "demarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, cliques sur "créer" puis "ok".Voilà, maintenant le point de restauration est créer si un jour tu décides tu pourra revenir en arriere à la date que tu l'as créer donc à ce jour;  en fesant la marche arriére tu pourra remettre ton ordinateur à la date ou l'on à créer ce point de restauration mais tu perdra les modifications que tu aura faites entre deux.

phk30 · Answer

bonjour j'i annulé les poit restaur mais que veut tu dire parC:\e01144c5d\update\update.exe que faut il fairesi j'ai ecrit ce matin j'allais au travail et toi tu dormais pas encore merci encore pour tous ses conseil et à bientot

Utilisateur anonyme · Answer

Salut,pour ce qui est de "C:\e01144c5d\update\update.exe" ça veut dire que si tu cliques sur C: tu dosi avoir un dossier nommé "e01144c5d" le connais-tu ce dossier ? sinon, supprime le car il me semble très suspect

phk30 · Answer

re lorsque j'essaye de le supprimé une fenetre s'ouvreerreur lors de la suppréssion du fichier ou du dossierimpossible de supprimer update accès refusévérifier que le disque n'est pas plein ou protégé en écriture et que le fichier n'est pas utilisé actuellementque faire merci?

Utilisateur anonyme · Answer

supprime le en mdoe sans echec:**Si un fichier persiste lors de la suppression fais ceci:-Redemarres ton pc, dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaitre choisis "mode sans echec" attends un peu.. puis vas supprimer les fichiers/dossiers qui persistaient, vides ta corbeille et redemarres normalement

phk30 · Answer

re j'ai essayé de les supprimé dans le C impossible en mode sans echec merci

phk30 · Answer

salut à demain je vais dormir imossible d'effacer ces 4 fichier update avec 0 espace disque merci et à tout à l'heure bonne nuit

Utilisateur anonyme · Answer

ok, bonne nuit, donc demain fait çaTelecharges Killbox: https://www.generation-nt.com/killbox-telechargement-25430.html Doubles clique sur killbox.exe (Pocket Killbox)- coches: delete on rebootdans la barre vide entre ceci: (exactement)C:\e01144c5d\update\update.exe- cliques sur la croix rouge- une fenetre va apparaitre pour confirmation cliques sur YES- une seconde fenetre te demande si tu veux redemarrer cliques sur YESLaisses le pc redemarrer puis mets un nouveau rapport HijackThis

phk30 · Answer

bonjour je ferais ça ce soir mais voici un rapport kasper, comment enlevé ce trojan ou la t il enlevé merci à bientotKASPERSKY ONLINE SCANNER REPORT  Monday, September 25, 2006 5:43:08 AMOperating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)Kaspersky Online Scanner version: 5.0.83.0Kaspersky Anti-Virus database last update: 25/09/2006Kaspersky Anti-Virus database records: 212993  Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true  Scan Target My Computer A:\C:\D:\E:\F:\G:\H:\I:\   Scan Statistics Total number of scanned objects 113327 Number of viruses found 1 Number of infected objects 1 / 0 Number of suspicious objects 0 Duration of the scan process 01:38:04 Infected Object Name Virus Name Last Action C:\bf80d5931cf68876c08269b764829550\update\update.exe  Object is locked  skipped   C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\DSS\MachineKeys\9224d8a476e4d060f25cf94c769367a5_287280f2-35d4-4f0c-a380-7d5f95f91af2  Object is locked  skipped   C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat  Object is locked  skipped   C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003
tuser.dat  Object is locked  skipped   C:\Documents and Settings\LocalService.AUTORITE NT.003
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003\NTUSER.DAT  Object is locked  skipped   C:\Documents and Settings\NetworkService.AUTORITE NT.003
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settingsichard_2\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Historique\History.IE5\MSHist012006092520060926\index.dat  Object is locked  skipped   C:\Documents and Settingsichard_2\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settingsichard_2
tuser.dat  Object is locked  skipped   C:\Documents and Settingsichard_2
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settingsichard_2\UserData\index.dat  Object is locked  skipped   C:\e01144c5d\update\update.exe  Object is locked  skipped   C:\fb8b5687976fd9d07e9c2418c\update\update.exe  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chn.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chn.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\D0000000.FCS  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\inuse.txt  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\L0000005.FCS  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\main.log  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_die.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_die.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_dnd.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_dnd.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_ext.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_ext.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_rcv.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_rcv.idx  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.dat  Object is locked  skipped   C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.idx  Object is locked  skipped   C:\Program Files\F-Secure\Common\policy.ipf  Object is locked  skipped   C:\System Volume Information\MountPointManagerRemoteDatabase  Object is locked  skipped   C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP425\change.log  Object is locked  skipped   C:\WINDOWS\Debug\PASSWD.LOG  Object is locked  skipped   C:\WINDOWS\SchedLgU.Txt  Object is locked  skipped   C:\WINDOWS\SoftwareDistribution\ReportingEvents.log  Object is locked  skipped   C:\WINDOWS\Sti_Trace.log  Object is locked  skipped   C:\WINDOWS\system32\config\AppEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\default  Object is locked  skipped   C:\WINDOWS\system32\config\default.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SAM  Object is locked  skipped   C:\WINDOWS\system32\config\SAM.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SecEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\SECURITY  Object is locked  skipped   C:\WINDOWS\system32\config\SECURITY.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\software  Object is locked  skipped   C:\WINDOWS\system32\config\software.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SysEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\system  Object is locked  skipped   C:\WINDOWS\system32\config\system.LOG  Object is locked  skipped   C:\WINDOWS\system32\h323log.txt  Object is locked  skipped   C:\WINDOWS\system32
vsvcd.exe  Infected: Trojan.Win32.Agent.xu  skipped   C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP  Object is locked  skipped   C:\WINDOWS\wiadebug.log  Object is locked  skipped   C:\WINDOWS\wiaservc.log  Object is locked  skipped   C:\WINDOWS\WindowsUpdate.log  Object is locked  skipped   Scan process completed.

Utilisateur anonyme · Answer

Salut,tu as toujours le même probléme, Clic sur demarrer, poste de travail, C: regarde à cet endroit tu as des fichiers bizarre comme ceci: C:\bf80d5931cf68876c08269b764829550  note les ici stpFait ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X; la barre anti-popup du SP2 (en haut) va se mettre à clignoter, clic dessus et choisis "accepter l'active X" pour  faire fonctionner le scan anti-virus.Une fois qu'il a terminé colle le rapport ici stphttps://www.bitdefender.com/toolbox/

phk30 · Answer

bonsoir j'essaye killbox mais il redemarre pas le pc
en effet j'ai 4 fichier byzarre dans le m^me style.
merci je vais réessayer killbox sinon je lance le scan birtdef
à bientot

phk30 · Answer

re j'ai lancé bitdef mais je n'arrive pas a utiliser killbox, après avoir fait tout se qui est notifier celui-ci ne redemarre pas le pc est ce que cela mais longtemps j'ai attendu 10 mn et rien que faire, merci à bientot

Utilisateur anonyme · Answer

rédémarre le Pc de toi même s'il n'a pas rédémarrer ;-)

phk30 · Answer

re bitdefender n'a rien trouvé, et killbox une fenetre s'affiche pending file rename operation
registry data has been removed by external process!
c'est quoi merci

phk30 · Answer

re pourkillbox je click sur la croix rouge, do you want to reboot now ? oui et après un efenetre s'ouvre verifying registry entries
plz wait click here to abort shutdown in et un compte à rebours de quelque secondes que faire? merci

Utilisateur anonyme · Answer

Salut,

supprime les fichiers bizarre coimme tu as dit à la racine de C: 

laisse tomber KillBox  et dis moi ou tu en es

phk30 · Answer

re que veux tu dire? je click sur 
poste de travail puis c et selectionne le fichier et demande supprimé mais il ne veut pas et ouvre une fenetre comme expliquer plus haut dans notre discussions merci à bientot

Utilisateur anonyme · Answer

il faut que tu les supprimes tous avec KillBox quand tu aura le message de KillBox à ce moment la, rédemarre ton Pc normalement

phk30 · Answer

quel message? merci

Utilisateur anonyme · Answer

celui que tu m'as noté taleur:
"verifying registry entries 
plz wait click here to abort shutdown in"

phk30 · Answer

ça marche pas, faut il mettre en single ou all files.merci

Séb08 · Answer

killbox une fenetre s'affiche pending file rename operation
registry data has been removed by external process! 

http://tinypic.com/images/goodbye.jpg

Ignore ce message !

Et mets le chemin exact des fichiers inquiètant.

Utilisateur anonyme · Answer

mais en single .. regarde comme l'exmple je t'ai doné au dessus ça fonctionne

phk30 · Answer

je n'est pas de 2ème fenetre qui s'ouvre c'est verifying registry entries qui s'ouvre et le compte à rebours?

Utilisateur anonyme · Answer

donc si l'ordi ne redémarre pas après ce compte à rebours alors rédemarre ton Pc manuellement

phk30 · Answer

ecoute cela ne marche pas je vais dormir la nuit porte conseil merci et  à demain.

phk30 · Answer

bonsoir, alors il n'y a pas de réponse merci et à demain bonne nuit

Utilisateur anonyme · Answer

Salut,

essaye avec ça:
http://www.generation-nt.com/telecharger/fiche/236/Unlocker/

phk30 · Answer

bonjour je l'ai installé mais je n'arrive pas à le lancer pourquoi? merci à bientot

phk30 · Answer

re killbox redemarre le pc! mais n'enleve pas ce fichier? merci

phk30 · Answer

re ou trouve ton le lien exact du fichier merci

Utilisateur anonyme · Answer

Salut,

voilà:
https://www.google.fr/search?hl=fr&q=telecharger+unlocker&btnG=&gws_rd=ssl
Recherche+Google&meta

phk30 · Answer

bonsoir j'ai essayer plusieurs telechargement il ne démarre pas une fois que je l'ai installé. byzarre?

phk30 · Answer

bonsoir pourquoi unlocker ne démarre pas merci? à bientot

Utilisateur anonyme · Answer

Salut,

laisse tomber tant pis! Scanne ton Pc avec ce logiciel et note ici les bestioles qu'il aura trouvées

Spycatcher Express Free: (en anglais, gratuit)
http://download.tenebril.com/pub/bin/spycatcher-express.exe

si tu as du mal avec l'Anglais, aide toi avec google
https://translate.google.com/

phk30 · Answer

bonjour vraiment j'ai tout essayer pour mettre unlocker impossible 
par contre spycatcher fonctionne il a trouvé pas mal de bestioles mais il y en a trop il sont en quarantaine et je n'arrive pas a copier coller est ce que je peux les supprimer? merci à bientot.

Utilisateur anonyme · Answer

Salut, 

le problème vient peut-être d'une de ces 40 bestioles que SpyCatcher t'a trouvé ..sert toi de Google pour savoir si tu peux les supprimer ou non; s'il est marqué trojan, spyware/adware, mailbomber tu selectionnes la ligne et tu choisis "remove" 

;-)

phk30 · Answer

bonjours se servir de google comment? j'ai misremove à tout les adware trojan et spyware, comment les enlèvent il spycatcher?
merci à bientot

Utilisateur anonyme · Answer

Salut,

tu vas sur Google : https://www.google.fr/?gws_rd=ssl tu tapes le processus du programme espions qu'il t'a trouvé par exemple abcde.exe puis tu regardes les pages dans Google ça devrait t'indiquer si le processus est correct ou non.T'inquiètes pas si tu as choisis "remove" ils ne sont plus là ..

phk30 · Answer

bonsoir et merci je vais garder tous ça et peut-être à bientot pour de nouvelle aventure encore merci.

phk30 · Answer

RE se n'est pas fini voici un rapport kasperski
KASPERSKY ONLINE SCANNER REPORT  
Tuesday, October 03, 2006 1:54:52 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 2/10/2006
Kaspersky Anti-Virus database records: 215173
 
 
Scan Settings 
Scan using the following antivirus database standard 
Scan Archives true 
Scan Mail Bases true 
 
Scan Target My Computer 
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\  
 
Scan Statistics 
Total number of scanned objects 120896 
Number of viruses found 1 
Number of infected objects 1 / 0 
Number of suspicious objects 0 
Duration of the scan process 01:42:35 

Infected Object Name Virus Name Last Action 
C:\a21cada58431c0fa263cb38\update\update.exe  Object is locked  skipped  
 
C:\bf80d5931cf68876c08269b764829550\update\update.exe  Object is locked  skipped  
 
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\DSS\MachineKeys\9224d8a476e4d060f25cf94c769367a5_287280f2-35d4-4f0c-a380-7d5f95f91af2  Object is locked  skipped  
 
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat  Object is locked  skipped  
 
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat  Object is locked  skipped  
 
C:\Documents and Settings\LocalService.AUTORITE NT.003\Cookies\index.dat  Object is locked  skipped  
 
C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped  
 
C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped  
 
C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped  
 
C:\Documents and Settings\LocalService.AUTORITE NT.003\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped  
 
C:\Documents and Settings\LocalService.AUTORITE NT.003
tuser.dat  Object is locked  skipped  
 
C:\Documents and Settings\LocalService.AUTORITE NT.003
tuser.dat.LOG  Object is locked  skipped  
 
C:\Documents and Settings\NetworkService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped  
 
C:\Documents and Settings\NetworkService.AUTORITE NT.003\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped  
 
C:\Documents and Settings\NetworkService.AUTORITE NT.003\NTUSER.DAT  Object is locked  skipped  
 
C:\Documents and Settings\NetworkService.AUTORITE NT.003
tuser.dat.LOG  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Cookies\index.dat  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Historique\History.IE5\MSHist012006100320061004\index.dat  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Temp\fnm37.tmp  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Temp\fnm48.tmp  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Temp\fnm65.tmp  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Temp\fnm66.tmp  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped  
 
C:\Documents and Settingsichard_2
tuser.dat  Object is locked  skipped  
 
C:\Documents and Settingsichard_2
tuser.dat.LOG  Object is locked  skipped  
 
C:\Documents and Settingsichard_2\UserData\index.dat  Object is locked  skipped  
 
C:\e01144c5d\update\update.exe  Object is locked  skipped  
 
C:\fb8b5687976fd9d07e9c2418c\update\update.exe  Object is locked  skipped  
 
C:\Program Files\F-Secure\Common\policy.ipf  Object is locked  skipped  
 
C:\System Volume Information\MountPointManagerRemoteDatabase  Object is locked  skipped  
 
C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP435\A0230476.exe  Infected: Trojan.Win32.Agent.xu  skipped  
 
C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP435\change.log  Object is locked  skipped  
 
C:\WINDOWS\Debug\PASSWD.LOG  Object is locked  skipped  
 
C:\WINDOWS\SchedLgU.Txt  Object is locked  skipped  
 
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log  Object is locked  skipped  
 
C:\WINDOWS\Sti_Trace.log  Object is locked  skipped  
 
C:\WINDOWS\system32\CatRoot2\edb.log  Object is locked  skipped  
 
C:\WINDOWS\system32\CatRoot2	mp.edb  Object is locked  skipped  
 
C:\WINDOWS\system32\config\AppEvent.Evt  Object is locked  skipped  
 
C:\WINDOWS\system32\config\default  Object is locked  skipped  
 
C:\WINDOWS\system32\config\default.LOG  Object is locked  skipped  
 
C:\WINDOWS\system32\config\SAM  Object is locked  skipped  
 
C:\WINDOWS\system32\config\SAM.LOG  Object is locked  skipped  
 
C:\WINDOWS\system32\config\SecEvent.Evt  Object is locked  skipped  
 
C:\WINDOWS\system32\config\SECURITY  Object is locked  skipped  
 
C:\WINDOWS\system32\config\SECURITY.LOG  Object is locked  skipped  
 
C:\WINDOWS\system32\config\software  Object is locked  skipped  
 
C:\WINDOWS\system32\config\software.LOG  Object is locked  skipped  
 
C:\WINDOWS\system32\config\SysEvent.Evt  Object is locked  skipped  
 
C:\WINDOWS\system32\config\system  Object is locked  skipped  
 
C:\WINDOWS\system32\config\system.LOG  Object is locked  skipped  
 
C:\WINDOWS\system32\h323log.txt  Object is locked  skipped  
 
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR  Object is locked  skipped  
 
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP  Object is locked  skipped  
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER  Object is locked  skipped  
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP  Object is locked  skipped  
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP  Object is locked  skipped  
 
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA  Object is locked  skipped  
 
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP  Object is locked  skipped  
 
C:\WINDOWS\wiadebug.log  Object is locked  skipped  
 
C:\WINDOWS\wiaservc.log  Object is locked  skipped  
 
C:\WINDOWS\WindowsUpdate.log  Object is locked  skipped  
 
Scan process completed.

phk30 · Answer

Internet Explorer 4+ is required for the Online Scanner to work.     

Click here to download the latest version of Internet Explorer. 
 
END USER SOFTWARE LICENSE AGREEMENT

Please read and accept the terms of use of this software. 
IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS DO NOT USE THE SOFTWARE. BY INSTALLING OR USING THE SOFTWARE IN ANY WAY, YOU ARE INDICATING YOUR COMPLETE UNDERSTANDING AND ACCEPTANCE OF THE TERMS OF THIS AGREEMENT.

This License Agreement is a legal agreement between you (either an individual or a single entity end user) and SOFTWIN SRL for use of the SOFTWIN software product identified above, which includes computer software and may include associated media, printed materials, and "online" or electronic documentation ("BitDefender"), all of which are protected by U. S. copyright laws and international treaty protection. By installing, copying, or otherwise using the BitDefender, you agree to be bound by the terms of this agreement. If you do not agree to the terms of this agreement, do not install or use the BitDefender; you may, however, return it to your place of purchase for a full refund within 30 days after your purchase. Verification of your purchase may be required. 
------------------------------------------------------------------
BitDefender LICENSE
------------------------------------------------------------------
BitDefender is protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. The BitDefender is licensed, not sold. 

------------------------------------------------------------------
GRANT OF LICENSE. SOFTWIN SRL hereby grants you and only you the following non-exclusive license to use BitDefender:

------------------------------------------------------------------
APPLICATION SOFTWARE. You may install and use one copy of the BitDefender, or any prior version for the same operating system, on a single computer terminal. The primary user of the computer on which the BitDefender is installed may make one additional (i.e. second) copy for his or her exclusive use on a portable computer.

------------------------------------------------------------------
NETWORK USE. You may also store or install a copy of the BitDefender on a storage device, such as a network server, used only to install or run the BitDefender on your other computers over an internal network; however, you must purchase and dedicate a separate license for each separate computer terminal on which the BitDefender is installed or run from the storage device. A license for the BitDefender may not be shared or used concurrently on different computers or computer terminals. You should purchase a license pack if you require multiple licenses for use on multiple computers or computer terminals.

------------------------------------------------------------------
LICENSE PACKS.If you purchase a License Pack and you have acquired this License Agreement for multiple licenses of BitDefender, you may make the number of additional copies of the computer software portion of the BitDefender specified above as "Licensed copies." You are also entitled to make a corresponding number of secondary copies for portable computer use as specified above in the section entitled "Application Software". 

------------------------------------------------------------------
TERM OF LICENSE. The license granted hereunder shall commence on the date that you install, copy or otherwise first use BitDefender and shall continue only on the computer on which it is initially installed.

------------------------------------------------------------------
UPGRADES. If the BitDefender is labeled as an upgrade, you must be properly licensed to use a product identified by SOFTWIN as being eligible for the upgrade in order to use the BitDefender. An BitDefender labeled as an upgrade replaces and/or supplements the product that formed the basis for your eligibility for the upgrade. You may use the resulting upgraded product only in accordance with the terms of this License Agreement. If the BitDefender is an upgrade of a component of a package of software programs that you licensed as a single product, the BitDefender may be used and transferred only as part of that single product package and may not be separated for use on more than one computer. 

------------------------------------------------------------------
COPYRIGHT. All right, title and interest in and to BitDefender and all copyright rights in and to the BitDefender (including but not limited to any images, photographs, animations, video, audio, music, text, and "applets" incorporated into the BitDefender), the accompanying printed materials, and any copies of the BitDefender are owned by SOFTWIN or its suppliers. The BitDefender is protected by copyright laws and international treaty provisions. Therefore, you must treat the BitDefender like any other copyrighted material except that you may install the BitDefender on a single computer provided you keep the original solely for backup or archival purposes. You may not copy the printed materials accompanying the BitDefender. You must produce and include all copyright notices in their original form for all copies created irrespective of the media or form in which BitDefender exists. You may not sub-license, rent, sell, or lease BitDefender. You may not reverse engineer, recompile, disassemble, create derivative  works, modify, translate, or make any attempt to discover the source code for BitDefender. 

------------------------------------------------------------------
LIMITED WARRANTY. SOFTWIN SRL warrants that the media on which BitDefender is distributed is free from defects for a period of thirty days from the date of delivery of BitDefender to you. Your sole remedy for a breach of this warranty will be that SOFTWIN SRL, at its option, may replace the defective media upon receipt of the damaged media, or refund the money you paid for BitDefender. SOFTWIN SRL does not warrant that BitDefender will be uninterrupted or error free or that the errors will be corrected. SOFTWIN SRL does not warrant that BitDefender will meet your requirements. SOFTWIN SRL HEREBY DISCLAIMS ALL OTHER WARRANTIES FOR BitDefender, WHETHER EXPRESSED OR IMPLIED. THE ABOVE WARRANTY IS EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, WHETHER EXPRESSED OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. THIS WARRANTY GIVES YOU SPECIFIC LEGAL RIGHTS. YOU MAY HAVE OTHER RIGHTS, WHICH VARY FROM STATE TO STATE. 

------------------------------------------------------------------
DISCLAIMER OF DAMAGES. Anyone using, testing, or evaluating BitDefender bears all risk to the quality and performance of BitDefender. In no event shall SOFTWI N SRL be liable for any damages of any kind, including, without limitation, direct or indirect damages arising out of the use, performance, or delivery of BitDefender, even if SOFTWIN SRL has been advised of the existence or possibility of such damages. SOME STATES DO NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU. IN NO CASE SHALL SOFTWIN SRL'S LIABILITY EXCEED THE PURCHASE PRICE PAID BY YOU FOR BitDefender. The disclaimers and limitations set forth above will apply regardless of whether you accept or use, evaluate, or test BitDefender.

------------------------------------------------------------------
IMPORTANT NOTICE TO USERS. THIS SOFTWARE IS NOT FAULT-TOLERANT AND IS NOT DESIGNED OR INTENDED FOR USE IN ANY HAZARDOUS ENVIRONMENT REQUIRING FAIL-SAFE PERFORMANCE OR OPERATION. THIS SOFTWARE IS NOT FOR USE IN THE OPERATION OF AIRCRAFT NAVIGATION, NUCLEAR FACILITIES, OR COMMUNICATION SYSTEMS, WEAPONS SYSTEMS, DIRECT OR INDIRECT LIFE-SUPPORT SYSTEMS, AIR TRAFFIC CONTROL, OR ANY APPLICATION OR INSTALLATION WHERE FAILURE COULD RESULT IN DEATH, SEVERE PHYSICAL INJURY OR PROPERTY DAMAGE. 

------------------------------------------------------------------
GENERAL. This Agreement will be governed by the laws of Romania. This Agreement may only be modified by a license addendum, which accompanies this Agreement or by a written document which has been signed, by both you and SOFTWIN SRL. This Agreement has been written in the English language only and is not to be translated or interpreted in any other language. Prices, costs and fees for use of BitDefender are subject to change without notice to you. In the event of invalidity of any provision of this Agreement, the invalidity shall not affect the validity of the remaining portions of this Agreement. BitDefender and AVX are trademarks of SOFTWIN SRL. Microsoft, Windows, Excel, Word, the Windows logo, Windows NT, Windows 2000 are registered trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners. 
  SCANNING OPTIONS  
Select what you want to check for viruses  
By default, your entire computer will be checked for viruses and other threats. To scan just some of your folders, click here.  
Settings  
By default, BitDefender will try to clean the infected files it finds. Warning If the disinfection fails, the infected files will be deleted without prompt. To change this and other settings, click here. Please use these options with care.  
   
 »  Frequently Asked Questions
 
  
»  Get BitDefender 9 Professional Plus
 
  
»  Ten Commandments for your computer sanity 
 
  
»  Subscribe to the BitDefender Newsletter 
 
  
»  Visit the BitDefender Security Portal
 
  
 
  
   
   
  
  
Please wait while the scanner is loading...    Could not load the Online Scanner!     
Service Pack 2 was detected on this computer.
Click on the information bar and select "Install ActiveX Control...".  

»  Click here for other possible fixes.  

--------------------------------------------------------------------------------
 
  
  
 Free Online Virus Scanner

BitDefender Online Scanner is a fully functional antivirus product. It features all required elements for thorough antivirus scanning and effective cleaning: it scans your system's memory, all files, folders and drives' boot sectors, providing you with the option to automatically clean the infected files. 
  
    
   
voici la page bitdefender qui ne veut pas se lancer sans activex je ne conprend pas? merci

Utilisateur anonyme · Answer

il y a toujours ces dexu trucs bizarre qui réaparraissent toujours

C:\a21cada58431c0fa263cb38\update\update.exe Object is locked skipped 

C:\bf80d5931cf68876c08269b764829550\update\update.exe Object is locked skipped


quand tu les virus ils reviennent ? 


Puis fait ça:

Alors ceci; C:\System Volume Information\_restore(voir rapport Kaspersky) indique que ta restauration du systeme  etait infecté ou est infecté, pour être sûr, nous allons créer un point propre.

Clic sur "demarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du systeme"

¤ coches la case "desactiver la Restauration du systéme sur tous les lecteurs", puis clic ur "appliquer" 
¤ decoches la case et clic sur "appliquer" puis "ok".

Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre:

Clic sur "demarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, cliques sur "créer" puis "ok".
Voilà, maintenant le point de restauration est créer si un jour tu décides tu pourra revenir en arriere à la date que tu l'as créer donc à ce jour;  en fesant la marche arriére tu pourra remettre ton ordinateur à la date ou l'on à créer ce point de restauration mais tu perdra les modifications que tu aura faites entre deux.

phk30 · Answer

bonjour je n'ai pas encore fait cela mais voici le rapport bitdef
BitDefender Online Scanner
  
  
 
Scan report generated at: Tue, Oct 03, 2006 - 04:23:17
 
 
  
  
 
Scan path: A:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;
  
  
 
 
  
  
 
Statistics
 
Time
 01:53:07
 
Files
 363883
 
Folders
 4238
 
Boot Sectors
 2
 
Archives
 2277
 
Packed Files
 30442
 
  
  
 
Results
 
Identified Viruses 
 1
 
Infected Files 
 1
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 1
 
  
  
 
Engines Info
 
Virus Definitions
 473534
 
Engine build
 AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
 
Scan plugins
 13
 
Archive plugins
 38
 
Unpack plugins
 6
 
E-mail plugins
 6
 
System plugins
 1
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP435\A0230476.exe
 Infected with: Trojan.Agent.XU
 
C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP435\A0230476.exe
 Disinfection failed
 
C:\System Volume Information\_restore{845BA11C-26AC-44FF-9012-55F0DBA037F8}\RP435\A0230476.exe
 Deleted
 
  
 
 et hitjackthis
  
  
 Logfile of HijackThis v1.99.1
Scan saved at 11:14:10, on 03/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\richard_2\Mes documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {DCBC412F-DBD7-4F75-B201-07F06C7843D5} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher 2006\Protector.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2e3e6af8f1de44fbaa285ba52558494b
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2e3e6af8f1de44fbaa285ba52558494b
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3
O17 - HKLM\System\CS3\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: interceptor.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE (file missing)
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe (file missing)
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

je vais faire ce que tu m'a dit cette AM merci à bientot

Utilisateur anonyme · Answer

Salut,

rapport Bitdefender: toujours la restauration qui est infecté, donc voir plus haut la manip

rapport hijackthis: c'est ok :-)


Tu me dire ou en est ton problème stp

A++

phk30 · Answer

bonjour fait le point de restauration, maintenant il faut nettoyer non? merci à bientot

phk30 · Answer

re unlocker fonctionne mais il n'arrive pas à effacer ou deplacer ces 4 fichiers update bizarre? merci à bientot

Utilisateur anonyme · Answer

En mode sans echec, as tu esayé ?

phk30 · Answer

pareil ça ne les efface pas ils sont très coriace?

Utilisateur anonyme · Answer

Réssaye avec Killbox


Telecharges Killbox: 
http://www.killbox.net/downloads/KillBox.exe

Doubles clique sur killbox.exe (Pocket Killbox)

- coches: delete on reboot
dans la barre vide entre ceci: (exactement)

C:\a21cada58431c0fa263cb38\update\update.exe

- cliques sur le rond rouge avec la croix blanche
- une fenetre va apparaitre pour confirmation cliques sur YES
- une seconde fenetre te demande si tu veux redemarrer cliques sur YES


Laisses le pc redemarrer ou redémarre le de toi même s'il ne redémarre pas et vois si le ficheir est bien parti

phk30 · Answer

pariel impossible de l'effacer faut il taper le lien car je fait un copier coller c'est pareil? tout ça on l'a déjà fait il y a peut être un autre moyen? merci

phk30 · Answer

bonsoir comment les supprimer merci à bientot

Utilisateur anonyme · Answer

Salut,

bah j'en sais rien mdr! mode sans echec, marche pas, unlocker marche pas, killbox apparement marche pas..il reste un moyen mais faut je le retrouve avec Chaos peut-être que .. je t'en ferai part dès j'le retrouve

phk30 · Answer

bonsoir ok merci à bientot alors

Séb08 · Answer

Désactive ta restauration système (uniquement si tu es sous XP): 
Clic droit sur poste de travail puis, 
propriété, tu cliques sur onglet restauration système 
tu coches la case « désactiver la restauration » et applique. 


Pour vérifier, scanne ton PC avec cet antivirus en ligne (sous IE et accepte l’activX) : 

http://www.bitdefender.fr/bd/site/search.php#

Clique sur « scan on line »  suis les instructions.

Et colle le rapport STP

A+

phk30 · Answer

bonsoir bitdefender en cours merci, donc scanonline en ayant désactivé la restauration si j'ai  bien compris, merci à bientot

phk30 · Answer

bonjour bitdefender n'a rien trouvé, et comment enlever c'est 4 fichier update merci voici hitjacthis pour vous aider.
Logfile of HijackThis v1.99.1
Scan saved at 13:55:04, on 09/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Ahead\Nero
ero.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settingsichard_2\Mes documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {DCBC412F-DBD7-4F75-B201-07F06C7843D5} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher 2006\Protector.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2e3e6af8f1de44fbaa285ba52558494b
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2e3e6af8f1de44fbaa285ba52558494b
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3
O17 - HKLM\System\CS3\Services\Tcpip\..\{3512A9E3-CEB6-47FB-9266-55D5E49A36CE}: NameServer = 80.10.246.130 80.10.246.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: interceptor.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE (file missing)
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe (file missing)
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

Séb08 · Answer

C'est bon alors si Bitdefender ne trouve rien !

Si tu as encore ces fichiers (update.exe) scanne les un par un avec ceci :

http://www.virustotal.com/en/virustotalx.html

clique sur "parcourir" va recherche le fichier en question et ensuite "send" copie/colle le rappport pour chaque.

a+

phk30 · Answer

bonsoir je n'arrive pas a les selectionner peut on les ecrire manuellement merci, j'ai f secure qui est en dysfonctionnement depuis cette AM je n'arrive pas à le reparer merci

Utilisateur anonyme · Answer

ça change rien au problème Sèb, c'est que l'on arrive pas à les virer, n'y KillBox, sans echec, Unlocker ..

Avec Chaos ? mais je sais pas l'utiliser

phk30 · Answer

bonsoir boulepate62, et avec le dos ?
j'ai réinstallé fsecure c'est ok.
merci à bientot

Utilisateur anonyme · Answer

Salut Phk,

oui, tu peux essayer sous dos ;-) 

démarrer, exécuter: cmd 
C:\DEL fichierasupprimer

phk30 · Answer

bonsoir ça marche pas dans dos la fenetre note c:\documents setting richard,
je n'est pas l'invite seul
merci à bientot

pixelius · Answer

je vous envoi le rrapport pour mon prelier ordi dites moi si tt est ok, je vais faire le meme rapport pour le portablre qui est infecté
merci beaucoup d'vance
jp





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:29:24, on 01/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\MGE\RunSC.exe
C:\WINDOWS\system32\MGE\PCtl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\M-Audio Uno\UnoInst.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MGE\BIL.EXE
C:\WINDOWS\system32\MGE\CILRS232.EXE
C:\WINDOWS\system32\MGE\CILUSB.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\AOL\1167042482\ee\aolsoftware.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAME.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\9.bin\MWSSRCAS.DLL
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\dapbho.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\9.bin\MWSSRCAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\9.bin\MWSBAR.DLL
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {71D1708F-973D-4600-AF01-AD86688403AE} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\9.bin\mwsoemon.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1167042482\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo RX640 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAME.EXE /P31 "EPSON Stylus Photo RX640 Series" /O6 "USB002" /M "Stylus Photo RX640"
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s  -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\9.bin\mwsoemon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\9.bin\MWSOEMON.EXE
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\9.bin\MWSOEMON.EXE
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZF
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {EF4DCD99-D26B-44A4-BA77-CFDCC97E7291} - https://www.afternic.com/domains/downloadv3.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{E92A4128-2808-4380-BEE3-A55595E3106F}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: MGE Service module - Unknown owner - C:\WINDOWS\system32\MGE\RunSC.exe
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Trojan system 32 faire rapport hitjackthis ? - Page 5

Discussions similaires

Newsletters