trojan w32 looksky + rapport Fermé

Question

Bonjour,

Comme beaucoup de monde sur ce forum j'ai un trojan W32 looksky, je vous joint le rapport Hijackthis.
Merci pour votre aide.
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hercules\Audio\DJ Console Series\MK2\HDJ2CPL.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\PhotoImpression 5\PI Monitor.exe
C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Val\Local Settings\Temporary Internet Files\Content.IE5\MJ52K6EO\HiJackThis_v2[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.159:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {208D7BCC-9857-4C9E-823B-D04E72490A67} - C:\WINDOWS\duocore.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: MSVPS System - {283A0EE3-2CC1-45AB-8207-B1D7B69C7F83} - C:\WINDOWS\duocore.dll
O2 - BHO: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [DJ Console Mk2] C:\Program Files\Hercules\Audio\DJ Console Series\MK2\HDJ2CPL.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: .protected
O4 - Startup: DLHelperEXE.exe
O4 - Global Startup: .protected
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PI Monitor.lnk = C:\Program Files\ArcSoft\PhotoImpression 5\PI Monitor.exe
O4 - Global Startup: TrayMin210.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - E:\Noble Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - E:\Noble Poker\casino.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversFWBInitialSetup1.0.0.15.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version6/dlhelper.cab
O21 - SSODL: wmpenv - {601D1043-873A-4B64-BE0C-6E2082678B2E} - C:\WINDOWS\wmpenv.dll
O21 - SSODL: wmpconf - {2341E01F-D046-4132-8616-D5A81FE1B8E1} - C:\WINDOWS\wmpconf.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

TOPAZE · Answer

Moi je l ai enleve avec ça
http://siri.urz.free.fr/Fix/SmitfraudFix.php

papyber · Answer

ton rapport n'est pas complet, il manque l'en tête et c'est important pour connaître ta version de windows etc...

papyber · Answer

tu feras aussi ceci
Télécharge SmitfraudFix  de S!Ri, balltrap34 et moe31 
http://siri.urz.free.fr/Fix
Installe le à la racine de C\ : double clique sur l'exe pour le décompresser et lancer le fix. 
Utilisation ----- option 1 - Recherche : 
Double clique sur smitfraudfix.cmd  Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection. 
 Poste le rapport 
Attention : process.exe est détecté par certains antivirus comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.

freedom · Answer

voici le rapport

SmitFraudFix v2.216

Rapport fait à 14:38:22,82, 25/08/2007
Executé à partir de C:\Documents and Settings\Val\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hercules\Audio\DJ Console Series\MK2\HDJ2CPL.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\PhotoImpression 5\PI Monitor.exe
C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\.protected PRESENT !
C:\WINDOWS\duocore.dll PRESENT !
C:\WINDOWS\main_uninstaller.exe PRESENT !
C:\WINDOWS\privacy_danger PRESENT !
C:\WINDOWS\wmpconf.dll PRESENT !
C:\WINDOWS\wmpenv.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Val


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Val\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\Val\MENUDM~1\PROGRA~1\DMARRA~1\.protected PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\.protected PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Val\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau

C:\DOCUME~1\Val\Bureau\Error Cleaner.url PRESENT !
C:\DOCUME~1\Val\Bureau\Privacy Protector.url PRESENT !
C:\DOCUME~1\Val\Bureau\Spyware?Malware Protection.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\VideoAccessCodec\ PRESENT !
C:\Program Files\Video ActiveX Access\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\WINDOWS\privacy_danger\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F6136B6F-66A1-4FEE-B06C-39372AE5AA9D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F6136B6F-66A1-4FEE-B06C-39372AE5AA9D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F6136B6F-66A1-4FEE-B06C-39372AE5AA9D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

papyber · Answer

bien maintenant fais ceci
Comment aller en Mode sans échec lettre C
https://forum.pcastuces.com/sujet.asp?f=25&s=3902
·	Imprimer ceci.
·	Redémarrer l'ordinateur en mode sans échec en tapotant sur F5 (ou F8). L'accès à Internet devient alors impossible.
·	Double cliquer sur Smitfraudfix.exe.
·	Sélectionner 2 pour supprimer les fichiers responsables de l'infection.
·	A la question Voulez-vous nettoyer le registre ?], répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection. Le fix déterminera si le fichier wininet.dll est infecté. 
·	A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.
·	Quitter le programme en appuyant sur Q.
·	Redémarrer normalement et coller sur le forum le rapport généré.
 ainsi qu'un rapport hijack this

freedom · Answer

voici le rapport Smitfraudfix et le rapport hijack

SmitFraudFix v2.216

Rapport fait à 14:51:49,26, 25/08/2007
Executé à partir de C:\Documents and Settings\Val\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\.protected supprimé
C:\WINDOWS\duocore.dll supprimé
C:\WINDOWS\main_uninstaller.exe supprimé
C:\WINDOWS\privacy_danger\ supprimé
C:\WINDOWS\wmpconf.dll supprimé
C:\WINDOWS\wmpenv.dll supprimé
C:\DOCUME~1\Val\MENUDM~1\PROGRA~1\DMARRA~1\.protected supprimé
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\.protected supprimé
C:\DOCUME~1\Val\Bureau\Error Cleaner.url supprimé
C:\DOCUME~1\Val\Bureau\Privacy Protector.url supprimé
C:\DOCUME~1\Val\Bureau\Spyware?Malware Protection.url supprimé
C:\Program Files\Video ActiveX Access\ supprimé
C:\Program Files\VideoAccessCodec\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F6136B6F-66A1-4FEE-B06C-39372AE5AA9D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F6136B6F-66A1-4FEE-B06C-39372AE5AA9D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F6136B6F-66A1-4FEE-B06C-39372AE5AA9D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:59:54, on 25/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hercules\Audio\DJ Console Series\MK2\HDJ2CPL.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\PhotoImpression 5\PI Monitor.exe
C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Val\Bureau\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.159:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {208D7BCC-9857-4C9E-823B-D04E72490A67} - C:\WINDOWS\duocore.dll (file missing)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [DJ Console Mk2] C:\Program Files\Hercules\Audio\DJ Console Series\MK2\HDJ2CPL.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: DLHelperEXE.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PI Monitor.lnk = C:\Program Files\ArcSoft\PhotoImpression 5\PI Monitor.exe
O4 - Global Startup: TrayMin210.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - E:\Noble Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - E:\Noble Poker\casino.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversFWBInitialSetup1.0.0.15.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version6/dlhelper.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

papyber · Answer

lance hijack this pour un scan et coche les lignes suivantes
O2 - BHO: MSVPS System - {208D7BCC-9857-4C9E-823B-D04E72490A67} - C:\WINDOWS\duocore.dll (file missing)
O2 - BHO: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll (file missing)
O4 - Startup: DLHelperEXE.exe
O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - E:\Noble Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - E:\Noble Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version6/dlhelper.cab
ferme toutes tes fenêtres y compris internet et clique sur fixer l'objet

as tu encore des soucis?

minoukat · Answer

J'ai un fichier "backups" qui s'est mis sur mon bureau mais apparemment tout va bien.
Je dois garder ce fichier?

freedom · Answer

Je crois que c'est réparé.

J'ai juste un fichier backups sur mon bureau.
Je dois le garder? ou je peux le supprimer?

papyber · Answer

tu peux le supprimer ainsi que les outils utilisés

faire un scan antivirus en ligne avec internet explorer et accepter l'activex 
poster le rapport ici ensuite
https://www.bitdefender.fr/ 

En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE 
Dans la nouvelle fenêtre, clique sur I agree 
La fenêtre change encore, clique sur Click here to scan 
Les signatures se chargent, etc. 

tuto en image
http://pageperso.aol.fr/rginformatique/mapage/defender.htm

freedom · Answer

Juste une question :

Bitdefender scanne déjà depuis 1h et il me dit qu'il reste encore 11h. C'est normal??

freedom · Answer

C'est fini. Voici le rapport de bitdefender.
BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Sat, Aug 25, 2007 - 17:03:18
 
 
  
  
 
Voie d'analyse: A:\;C:\;D:\;E:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 00:57:25
 
Fichiers
 388861
 
Directoires
 8234
 
Secteurs de boot
 3
 
Archives
 1602
 
Paquets programmes
 13723
 
  
  
 
Résultats
 
Virus identifiés
 6
 
Fichiers infectés
 8
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 8
 
  
  
 
Info sur les moteurs
 
Définition virus
 749988
 
Version des moteurs
 AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
 
Analyse des plugins
 14
 
Archive des plugins
 37
 
Unpack des plugins
 6
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Poker\Poker 770\_SetupPoker[1].exe
 Détecté avec: Application.Casonline.DLL
 
C:\Poker\Poker 770\_SetupPoker[1].exe
 Echec de la désinfection
 
C:\Poker\Poker 770\_SetupPoker[1].exe
 Supprimé
 
C:\Program Files\MioNet\cmdow.exe
 Détecté avec: Application.Tool.Hidewindow.H
 
C:\Program Files\MioNet\cmdow.exe
 Echec de la désinfection
 
C:\Program Files\MioNet\cmdow.exe
 Supprimé
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049832.exe
 Infecté par: Dropped:Trojan.Downloader.Zlob.AAKA
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049832.exe
 Echec de la désinfection
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049832.exe
 Supprimé
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049854.exe
 Détecté avec: Application.Casonline.DLL
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049854.exe
 Echec de la désinfection
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049854.exe
 Supprimé
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049855.exe
 Détecté avec: Application.Tool.Hidewindow.H
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049855.exe
 Echec de la désinfection
 
C:\System Volume Information\_restore{6DD07A64-CA29-4CBA-A0CE-17EDBB162632}\RP517\A0049855.exe
 Supprimé
 
E:\logiciels\CyberLink\Temporary Internet Files\Content.IE5\S5MVO1AJ\LeGratuiX[1].exe
 Infecté par: Trojan.Dialer.QM
 
E:\logiciels\CyberLink\Temporary Internet Files\Content.IE5\S5MVO1AJ\LeGratuiX[1].exe
 Echec de la désinfection
 
E:\logiciels\CyberLink\Temporary Internet Files\Content.IE5\S5MVO1AJ\LeGratuiX[1].exe
 Supprimé
 
E:\logiciels\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll
 Infecté par: Trojan.Stpage.L
 
E:\logiciels\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll
 Echec de la désinfection
 
E:\logiciels\Program Files\ZangoToolbar\Bin\4.8.2.0\ZbHostIE.dll
 Supprimé
 
E:\logiciels\record now\msimg32.dll
 Détecté avec: Adware.Mywebsearch.G
 
E:\logiciels\record now\msimg32.dll
 Echec de la désinfection
 
E:\logiciels\record now\msimg32.dll
 Supprimé

vivike · Answer

j'ai besoin d'aide j'ai un trojan sur mon pc et je n'arrive meme plus à l'allumer il y a ecrit "windows ne peut pas demarrer correctement"
comment faire?
on me demande si je veux redemarrer en mode sans echec
merci de me répondre

freedom · Answer

poste un message perso et quelqu'un t'aidera
Moi j'ai même pas encore fini de sortir mon virus avec l'aide d'une personne compétente. Moi je ne le suis pas désolé
Courage

papyber · Answer

oui mais ton virus cette fois ci on sait d'où il vient!!!

E:\logiciels\CyberLink\Temporary Internet Files\Content.IE5<==vide tout ce que contient ce dossier

vide ta corbeille

Télécharge OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

clic double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :
Paste List of Files/Folders to be moved.

C:\Poker
C:\Program Files\MioNet
E:\logiciels\Program Files\ZangoToolbar
E:\logicielsecord now

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Yes.

fais un nouveau scan avec Bit Defender afin de vérifier qu'il ne reste rien

freedom · Answer

désolé j'ai du m'absenter.
Voici le rapport OTMoveIt.

C:\Poker\Poker 770\History\PSR20542622\Table moved successfully.
C:\Poker\Poker 770\History\PSR20542622 moved successfully.
C:\Poker\Poker 770\History moved successfully.
C:\Poker\Poker 770\data\videopoker_joker\animation moved successfully.
C:\Poker\Poker 770\data\videopoker_joker moved successfully.
C:\Poker\Poker 770\data\videopoker_jacks moved successfully.
C:\Poker\Poker 770\data\videopoker_4jacks moved successfully.
C:\Poker\Poker 770\data	able	opview\history moved successfully.
C:\Poker\Poker 770\data	able	opview\dialogs moved successfully.
C:\Poker\Poker 770\data	able	opview\coins moved successfully.
C:\Poker\Poker 770\data	able	opview\chat\chat_side moved successfully.
C:\Poker\Poker 770\data	able	opview\chat\chat_bottom moved successfully.
C:\Poker\Poker 770\data	able	opview\chat moved successfully.
C:\Poker\Poker 770\data	able	opview\cards moved successfully.
C:\Poker\Poker 770\data	able	opview\buttons moved successfully.
C:\Poker\Poker 770\data	able	opview\avatars moved successfully.
C:\Poker\Poker 770\data	able	opview\anim moved successfully.
C:\Poker\Poker 770\data	able	opview moved successfully.
C:\Poker\Poker 770\data	able\smallview\coins moved successfully.
C:\Poker\Poker 770\data	able\smallview\chat\chat_bottom moved successfully.
C:\Poker\Poker 770\data	able\smallview\chat moved successfully.
C:\Poker\Poker 770\data	able\smallview\buttons moved successfully.
C:\Poker\Poker 770\data	able\smallview\anim moved successfully.
C:\Poker\Poker 770\data	able\smallview moved successfully.
C:\Poker\Poker 770\data	able\anim moved successfully.
C:\Poker\Poker 770\data	able moved successfully.
C:\Poker\Poker 770\data\slots_lovemore20line\wintable moved successfully.
C:\Poker\Poker 770\data\slots_lovemore20line\sounds moved successfully.
C:\Poker\Poker 770\data\slots_lovemore20line\dollarball moved successfully.
C:\Poker\Poker 770\data\slots_lovemore20line moved successfully.
C:\Poker\Poker 770\data\slots_gold8line\wintable moved successfully.
C:\Poker\Poker 770\data\slots_gold8line\sounds moved successfully.
C:\Poker\Poker 770\data\slots_gold8line\fonts moved successfully.
C:\Poker\Poker 770\data\slots_gold8line\bonus\screen moved successfully.
C:\Poker\Poker 770\data\slots_gold8line\bonus moved successfully.
C:\Poker\Poker 770\data\slots_gold8line moved successfully.
C:\Poker\Poker 770\data\slots_desert20line\wintable moved successfully.
C:\Poker\Poker 770\data\slots_desert20line\sounds moved successfully.
C:\Poker\Poker 770\data\slots_desert20line\bonusgame moved successfully.
C:\Poker\Poker 770\data\slots_desert20line moved successfully.
C:\Poker\Poker 770\data\slots_cinerama5reel\wintable moved successfully.
C:\Poker\Poker 770\data\slots_cinerama5reel\sounds moved successfully.
C:\Poker\Poker 770\data\slots_cinerama5reel\bonus2\select moved successfully.
C:\Poker\Poker 770\data\slots_cinerama5reel\bonus2 moved successfully.
C:\Poker\Poker 770\data\slots_cinerama5reel\bonus\select moved successfully.
C:\Poker\Poker 770\data\slots_cinerama5reel\bonus moved successfully.
C:\Poker\Poker 770\data\slots_cinerama5reel moved successfully.
C:\Poker\Poker 770\data\shared\videopoker_jacks moved successfully.
C:\Poker\Poker 770\data\shared\videopoker_4line\buttons moved successfully.
C:\Poker\Poker 770\data\shared\videopoker_4line moved successfully.
C:\Poker\Poker 770\data\shared	ablesigns moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\valleygirl moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\oldtourist moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\olderbusinesswoman moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\mafiaguy moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\frenchman moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\frenchgirl moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\cowboy moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\bond moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\blackdude moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds\baseballer moved successfully.
C:\Poker\Poker 770\data\shared\sounds\playersounds moved successfully.
C:\Poker\Poker 770\data\shared\sounds\dealervoices
umbers moved successfully.
C:\Poker\Poker 770\data\shared\sounds\dealervoices moved successfully.
C:\Poker\Poker 770\data\shared\sounds moved successfully.
C:\Poker\Poker 770\data\shared\html\chat\emoticons moved successfully.
C:\Poker\Poker 770\data\shared\html\chat moved successfully.
C:\Poker\Poker 770\data\shared\html moved successfully.
C:\Poker\Poker 770\data\shared\history\cards moved successfully.
C:\Poker\Poker 770\data\shared\history moved successfully.
C:\Poker\Poker 770\data\shared\doublescreen moved successfully.
C:\Poker\Poker 770\data\shared\dollarball\sounds moved successfully.
C:\Poker\Poker 770\data\shared\dollarball moved successfully.
C:\Poker\Poker 770\data\shared\coins	ablecoins moved successfully.
C:\Poker\Poker 770\data\shared\coins moved successfully.
C:\Poker\Poker 770\data\shared\cards	extures moved successfully.
C:\Poker\Poker 770\data\shared\cards\poker moved successfully.
C:\Poker\Poker 770\data\shared\cards moved successfully.
C:\Poker\Poker 770\data\shared\buttons moved successfully.
C:\Poker\Poker 770\data\shared\blackjack moved successfully.
C:\Poker\Poker 770\data\shared\9line moved successfully.
C:\Poker\Poker 770\data\shared moved successfully.
C:\Poker\Poker 770\dataoulette\zoom moved successfully.
C:\Poker\Poker 770\dataoulette\sounds moved successfully.
C:\Poker\Poker 770\dataoulette\buttons moved successfully.
C:\Poker\Poker 770\dataoulette\3d moved successfully.
C:\Poker\Poker 770\dataoulette moved successfully.
C:\Poker\Poker 770\data\poker_caribbean moved successfully.
C:\Poker\Poker 770\data\poker\chat\cards moved successfully.
C:\Poker\Poker 770\data\poker\chat moved successfully.
C:\Poker\Poker 770\data\poker\3d moved successfully.
C:\Poker\Poker 770\data\poker moved successfully.
C:\Poker\Poker 770\data\lobby\waitinglist moved successfully.
C:\Poker\Poker 770\data\lobby	ables moved successfully.
C:\Poker\Poker 770\data\lobby\sidegames moved successfully.
C:\Poker\Poker 770\data\lobby\login moved successfully.
C:\Poker\Poker 770\data\lobby\dialogs moved successfully.
C:\Poker\Poker 770\data\lobby\buttons moved successfully.
C:\Poker\Poker 770\data\lobby moved successfully.
C:\Poker\Poker 770\data\common\ui moved successfully.
C:\Poker\Poker 770\data\common\options moved successfully.
C:\Poker\Poker 770\data\common\interface\chat moved successfully.
C:\Poker\Poker 770\data\common\interface moved successfully.
C:\Poker\Poker 770\data\common\fonts moved successfully.
C:\Poker\Poker 770\data\common moved successfully.
C:\Poker\Poker 770\data\casinowar moved successfully.
C:\Poker\Poker 770\data\blackjack moved successfully.
C:\Poker\Poker 770\data moved successfully.
C:\Poker\Poker 770 moved successfully.
C:\Poker moved successfully.
C:\Program Files\MioNet\senvidData	empUpdate moved successfully.
C:\Program Files\MioNet\senvidData moved successfully.
Folder cleanup  failed. C:\Program Files\MioNet\libs scheduled to be deleted on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\ZoneInfoMappings scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\WET scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\MET scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\GMT scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\UTC scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\UCT scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-9 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-8 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-7 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-6 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-5 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-4 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-3 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-2 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-14 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-13 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-12 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-11 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-10 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT-1 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+9 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+8 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+7 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+6 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+5 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+4 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+3 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+2 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+12 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+11 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+10 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT+1 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\Etc\GMT scheduled to be moved on reboot.
C:\Program Files\MioNet\jvm\lib\zi\Etc moved successfully.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\EET scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\CET scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Yellowknife scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Yakutat scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Winnipeg scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Whitehorse scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Vancouver scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Tortola scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Tijuana scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Thunder_Bay scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Thule scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Tegucigalpa scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Swift_Current scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\St_Vincent scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\St_Thomas scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\St_Lucia scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\St_Kitts scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\St_Johns scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Scoresbysund scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Sao_Paulo scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Santo_Domingo scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Santiago scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Rio_Branco scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Regina scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Recife scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Rankin_Inlet scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Rainy_River scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Puerto_Rico scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Port_of_Spain scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Porto_Velho scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Port-au-Prince scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Phoenix scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Paramaribo scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Pangnirtung scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Panama scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\North_Dakota\Center scheduled to be moved on reboot.
C:\Program Files\MioNet\jvm\lib\zi\America\North_Dakota moved successfully.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Noronha scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Nome scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Nipigon scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\New_York scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Nassau scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Montserrat scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Montreal scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Montevideo scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Monterrey scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Miquelon scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Mexico_City scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Merida scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Menominee scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Mendoza scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Mazatlan scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Martinique scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Manaus scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Managua scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Maceio scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Louisville scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Los_Angeles scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Lima scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\La_Paz scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Kentucky\Monticello scheduled to be moved on reboot.
C:\Program Files\MioNet\jvm\lib\zi\America\Kentucky moved successfully.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Juneau scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Jujuy scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Jamaica scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Iqaluit scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Inuvik scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Indianapolis scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Indiana\Vevay scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Indiana\Marengo scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Indiana\Knox scheduled to be moved on reboot.
C:\Program Files\MioNet\jvm\lib\zi\America\Indiana moved successfully.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Hermosillo scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Havana scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Halifax scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Guyana scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Guayaquil scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Guatemala scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Guadeloupe scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Grenada scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Grand_Turk scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Goose_Bay scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Godthab scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Glace_Bay scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Fortaleza scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\El_Salvador scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Eirunepe scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Edmonton scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Dominica scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Detroit scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Denver scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Dawson_Creek scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Dawson scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Danmarkshavn scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Curacao scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Cuiaba scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Costa_Rica scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Cordoba scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Chihuahua scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Chicago scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Cayman scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Cayenne scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Catamarca scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Caracas scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Cancun scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Cambridge_Bay scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Buenos_Aires scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Boise scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Bogota scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Boa_Vista scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Belize scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Belem scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Barbados scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Asuncion scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Aruba scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Araguaina scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Antigua scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Anguilla scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Anchorage scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\zi\America\Adak scheduled to be moved on reboot.
C:\Program Files\MioNet\jvm\lib\zi\America moved successfully.
C:\Program Files\MioNet\jvm\lib\zi moved successfully.
Folder move failed. C:\Program Files\MioNet\jvm\lib	zmappings scheduled to be moved on reboot.
Folder move failed. C:\Program Files\MioNet\jvm\lib\security\cacerts scheduled to be moved on reboot.
C:\Program Files\MioNet\jvm\lib\security moved successfully.
C:\Program Files\MioNet\jvm\lib\images\cursors moved successfully.
C:\Program Files\MioNet\jvm\lib\images moved successfully.
C:\Program Files\MioNet\jvm\lib\im moved successfully.
C:\Program Files\MioNet\jvm\lib\i386 moved successfully.
C:\Program Files\MioNet\jvm\lib\fonts moved successfully.
Folder cleanup  failed. C:\Program Files\MioNet\jvm\lib\ext scheduled to be deleted on reboot.
C:\Program Files\MioNet\jvm\lib\cmm moved successfully.
Folder cleanup  failed. C:\Program Files\MioNet\jvm\lib scheduled to be deleted on reboot.
C:\Program Files\MioNet\jvm\bin\client moved successfully.
C:\Program Files\MioNet\jvm\bin moved successfully.
Folder cleanup  failed. C:\Program Files\MioNet\jvm scheduled to be deleted on reboot.
C:\Program Files\MioNet\install moved successfully.
Folder cleanup  failed. C:\Program Files\MioNet scheduled to be deleted on reboot.
E:\logiciels\Program Files\ZangoToolbar\Bin moved successfully.
E:\logiciels\Program Files\ZangoToolbar moved successfully.
E:\logicielsecord now\Tutorial\Movies moved successfully.
E:\logicielsecord now\Tutorial\FRA\images moved successfully.
E:\logicielsecord now\Tutorial\FRA moved successfully.
E:\logicielsecord now\Tutorial moved successfully.
E:\logicielsecord now\skins moved successfully.
E:\logicielsecord now\Nouveau dossier moved successfully.
E:\logicielsecord now\Explain\Images moved successfully.
E:\logicielsecord now\Explain moved successfully.
E:\logicielsecord now\Device Manager\Loc\9 moved successfully.
E:\logicielsecord now\Device Manager\Loc\7 moved successfully.
E:\logicielsecord now\Device Manager\Loc\6 moved successfully.
E:\logicielsecord now\Device Manager\Loc\31 moved successfully.
E:\logicielsecord now\Device Manager\Loc\29 moved successfully.
E:\logicielsecord now\Device Manager\Loc\22 moved successfully.
E:\logicielsecord now\Device Manager\Loc\20 moved successfully.
E:\logicielsecord now\Device Manager\Loc\19 moved successfully.
E:\logicielsecord now\Device Manager\Loc\16 moved successfully.
E:\logicielsecord now\Device Manager\Loc\12 moved successfully.
E:\logicielsecord now\Device Manager\Loc\11 moved successfully.
E:\logicielsecord now\Device Manager\Loc\1046 moved successfully.
E:\logicielsecord now\Device Manager\Loc\10 moved successfully.
E:\logicielsecord now\Device Manager\Loc moved successfully.
E:\logicielsecord now\Device Manager moved successfully.
E:\logicielsecord now\Apps\RecordNow moved successfully.
E:\logicielsecord now\Apps moved successfully.
E:\logicielsecord now moved successfully.
 
Created on 08/25/2007 20:30:03

freedom · Answer

J'ai lancé le scan avec Bitdefender mais ça va être long.
Donc j'espère qu'il ne reste plus rien sinon je serai là demain.
Merci beaucoup pour ton aide papyber.

papyber · Answer

ok!! j'attends la suite

freedom · Answer

ça y est!!
Cette fois ça doit être bon, bitdefender n'a rien trouvé.
Encore un grand merci à toi pour ton aide.

papyber · Answer

si tout va bien supprime tout ce qu'on a utilisé car ce ne sera plus utile désormais
conserve néanmoins ccleaner et effectue le nettoyage tous les jours avant de couper le PC

installe ce logiciel très utile et scanne ton PC avec une fois par semaine au moins...
AVG Antispyware
https://www.avg.com/en-ww/free-antivirus-download

mode d'utilisation : 
Lance AVG Anti-Spyware, mets le à jour,
Clique sur le bouton « Analyse »
Puis « Comment réagir », clique sur Actions recommandées. Sélectionne Quarantaine.
Retour à l'onglet Analyse. 
Clique sur Analyse complète du système.
A la fin du scan, choisis " Appliquer toutes les actions " 
Clique sur "Enregistrer le rapport". Le fichier texte se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.


tu peux le coupler avec celui-ci
spybot search and destroy
https://www.safer-networking.org/?page=download

défragmente

pense à bien te protéger, j'ai découvert ce lien qui est plutôt pas mal à ce sujet

https://forum.pcastuces.com/default.asp

désactive ta restauration
clique droit sur poste de travail/propriétés/coche la case désactiver la restauration, appliquer
redémarre ton PC
clique droit sur poste de travail/propriétés/décoche la case désactiver la restauration, appliquer
démarrer/tous les programmes/ outils système/ restauration du système/ créer un point de restauration


la sécurité c'est très important mais ne remplace pas l'internaute, un surf prudent en évitant le crack, les sites "chauds", permet déjà d'éviter bien des soucis, le P2P lui aussi est source d'infections...
 
 
et bon surf

freedom · Answer

Ok, je vais faire tout ce que tu me conseilles.
Encore merci pour tout.

Trojan w32 looksky + rapport

21 réponses

Discussions similaires