Tres gros beug!!!!!!

Résolu
xavierf1518 -  
Bonjour,je fais appel a vous car j'ai un gros soucis mon pc rame enormement impossible d'ouvrir avast, ccleaner et spybot , mon pare-feu c'est desactive, je ne peut pas faire de restauration systeme et impossible de demarer en mode sans echec.
j'ai essayer, en suivant les instructions de precedent forum d'installer hijasthis et antivir: impossible. le seul "truc" qui fonctionne c'est le scan en ligne de panda active scan qui tourne depuis deux jours!!!!!!!!!
je suis a l'ecoute de quiconque pourra me donner un petit coup de main.
ps: je suis sous xp sp2, IE 7.0
merci d'avance
Configuration: Windows XP
Internet Explorer 7.0

12 réponses

  • Votes
  • Date
  • Date décroissante
  1. g!rly Contributeur
    salut xavier,

    tu es infecté par bagle

    tu as telechargé un crack > supprime le de suite !

    puis

    Télécharge ELIBAGLA en bas de cette page
    http://www.zonavirus.com/datos/descargas/95/elibagla.asp (clique sur le bouton "Descargar Elibagla") sur ton bureau.

    Lance-le, de préférence en mode sans échec si tu en as la possibilité, en mode normal dans le cas contraire. Patiente le temps du scan.
    Lorsqu'il a terminé, poste le contenu du fichier infoSat.txt qui se trouve dans Poste de travail > Disque C:\
    Et par la même occasion, précise si tu peux à nouveau démarrer en mode sans échec.

    ***Ne pas rebooter en passant par msconfig.

    @+
    1. xavierf1518 Auteur
      tout d'abord merci de m'avoir repondu j'ai suivi ton raccourci mais impossible de telecharger quand enfin j'ai pu l'avoir je ne peut pas l'installer: application win32 pas valide
      que faire?
  2. g!rly Contributeur
    bon...

    on va essayer comme ceci :

    Tu va telecharger ce fix ( ne prete pas attention au nom : yojay > je l´ai utilisé pour un cas similaire, c´est pour cela qu´il porte le nom de l´autre personne > J´ai renommé l´application en esperant qu´il ne finisse pas en "n´est pas une application valide".)

    ici :

    http://sd-1.archive-host.com/membres/up/1366464061/Yojay.rar

    Tu le decompresse sur ton bureau puis n´y touche pas.

    Copie le texte ci-dessous :

    File::
    G:\WINDOWS\SYSTEM32\WINTEMS.EXE
    G:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE
    G:\WINDOWS\SYSTEM32\DRIVERS\MDELK.EXE
    G:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS

    Folder::
    G:\Windows\system32\drivers\down

    Driver::
    SROSA

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt.

    Glisse maintenant le fichier CFScript.txt dans Yojay.exe comme ci-dessous :

    http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

    Cela va relancer Combofix/Yojay,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Yojay.txt

    @´+
    1. xavierf1518 Auteur
      desole de repondre tardivement j'ai suivi tes instructions: tres efficace casimment tout refonctionne normalement par contre je n'ai rien de marque dans le rapport de yojay .
      j'ai fait un scan par spybot et il a effectivement trouve bagle qu'il a supprime.
      avast par contre refuse toujours de s'ouvrir: avast n'est pas une application win 32 valide : c'est normal?
  3. g!rly Contributeur
    re,

    essaie de supprimer/desinstaller avast et instale celui la a la place :

    Telecharge et instales l'antivirus Antivir Personal Edition Classic :

    ->https://www.malekal.com/avira-free-security-antivirus-gratuit/

    https://www.avira.com/en/prime

    le rapport de yojay.txt est situé a la racine de ton disk c:\

    peux tu poster un rapport hijack this egalement

    Télécharge HijackThis ici :

    -> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

    -> http://pageperso.aol.fr/balltrap34/Hijenr.gif

    Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

    -> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

    Post le rapport généré ici stp...

    @+
    1. xavierf1518 Auteur
      voici le rapport hijackthis:
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 08:05, on 2008-03-26
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16608)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\WINDOWS\system32\ps2.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\Unlocker\UnlockerAssistant.exe
      C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
      C:\Program Files\TomTom HOME 2\HOMERunner.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
      C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
      C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      C:\Program Files\RocketDock\RocketDock.exe
      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      C:\WINDOWS\system32\HPZipm12.exe
      C:\PROGRA~1\Wanadoo\ComComp.exe
      C:\WINDOWS\system32\svchost.exe
      C:\PROGRA~1\Wanadoo\Toaster.exe
      C:\PROGRA~1\Wanadoo\Inactivity.exe
      C:\PROGRA~1\Wanadoo\PollingModule.exe
      C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\PROGRA~1\Wanadoo\Watch.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
      C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
      O4 - HKLM\..\Run: [PSDrvCheck] C:\WINDOWS\system32\PSDrvCheck.exe
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinPatrol] "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe"
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] "C:\PROGRA~1\Wanadoo\GestMaj.exe" TaskBarIcon.exe
      O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKCU\..\Run: [WOOKIT] "C:\PROGRA~1\Wanadoo\Shell.exe" appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
      O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
      O4 - S-1-5-18 Startup: Thoosje Sidebar.lnk = C:\Program Files\Thoosje Sidebar V2.3\Thoosje Vista Sidebar.exe (User 'SYSTEM')
      O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
      O4 - .DEFAULT Startup: Thoosje Sidebar.lnk = C:\Program Files\Thoosje Sidebar V2.3\Thoosje Vista Sidebar.exe (User 'Default user')
      O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
      O4 - .DEFAULT User Startup: Thoosje Sidebar.lnk = C:\Program Files\Thoosje Sidebar V2.3\Thoosje Vista Sidebar.exe (User 'Default user')
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
      O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~2\Wanadoo Messager.exe
      O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
      O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
      O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
      O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
      O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
      O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-30.cab
      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
      O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://surcouf.metaboli.fr/components/Metaboli.ocx
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
      O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader.cab
      O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://jeuxentelechargement.orange.fr/online2/bejeweled2/Oberongamesloader.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
      O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
  4. g!rly Contributeur
    salut xavier,

    ok pour les rapports.

    supprime : C:\Documents and Settings\All Users\Application Data\crack.zip

    C´est quoi ca : C:\Documents and Settings\All Users\Application Data\Hyperballoid2_1660.exe?

    supprime : C:\WINDOWS\system32\wi1.exe

    puis

    instale ce par feu :

    Online armor :

    http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

    tuto : https://forum.pcastuces.com/sujet.asp?f=25&s=35606

    puis effectue un scan a l´aide de malwarebytes :

    Telecharge malwarebytes

    -> http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/anti-malware-sujet_197382_1.htm

    Tu l´instale; le programme va se mettre automatiquement a jour.

    Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

    Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

    Puis click sur "rechercher".

    Laisse le scanner le pc...

    Si des elements on ete trouvés > click sur supprimer la selection.

    si il t´es demandé de redemarrer > click sur "yes".

    A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

    Copie et colle le rapport stp.

    @+
    2. xavierf1518 Auteur
      ca y est j'ai suivi tes instructions
      voila le rapport malewarebytes:
      Malwarebytes' Anti-Malware 1.09
      Version de la base de données: 551

      Type de recherche: Examen complet (C:\|D:\|)
      Eléments examinés: 123299
      Temps écoulé: 56 minute(s), 0 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 2
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 1
      Fichier(s) infecté(s): 0

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_CURRENT_USER\Software\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      C:\WINDOWS\system32\drivers\down (Trojan.Downloader) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      (Aucun élément nuisible détecté)

      pour ce qui est de C:\Documents and Settings\All Users\Application Data\Hyperballoid2_1660.exe, il s'agit d'un jeu .

      A+
      1. g!rly Contributeur
        ok xavier,

        performe un scan a l´aide d´antivir avec les regalges ci dessous et post le rapport :

        une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
        puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
        coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
        puis sur la droite coche les case suivantes :
        scan boot sectors of selected drives
        scan master boot sectors
        scan memory
        search foe rootkit before scan
        decoche :
        ignore off line files
        toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

        @+
        1. xavierf1518 Auteur
          salut g!rly
          j'ai fait les reglages que tu m'as conseiller et il a effectivement trouves un malware
          je te laisse le rapport:

          AntiVir PersonalEdition Classic
          Report file date: 2008-03-27 09:26

          Scanning for 835736 virus strains and unwanted programs.

          Licensed to: Avira AntiVir PersonalEdition Classic
          Serial number: 0000149996-ADJIE-0001
          Platform: Windows XP
          Windows version: (Service Pack 2) [5.1.2600]
          Username: SYSTEM
          Computer name: NOM-EB85C523610

          Version information:
          BUILD.DAT : 270 15603 Bytes 2007-09-19 13:32:00
          AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 13:16:29
          AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 12:23:51
          LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 15:32:47
          LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 12:35:20
          ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 14:27:15
          ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 2007-09-13 14:26:55
          ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 2007-09-13 14:27:04
          ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 2007-09-13 14:27:13
          AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 2007-09-17 17:43:56
          AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 10:36:26
          AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 07:39:17
          AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 13:16:24
          AVPACK32.DLL : 7.3.0.15 360488 Bytes 2007-08-03 08:46:00
          AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 07:17:06
          AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 12:26:33
          AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 07:10:18
          NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 11:09:42
          RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 12:38:13
          RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 12:50:37
          SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 09:37:21

          Configuration settings for the scan:
          Jobname..........................: Complete system scan
          Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
          Logging..........................: low
          Primary action...................: interactive
          Secondary action.................: ignore
          Scan master boot sector..........: on
          Scan boot sector.................: on
          Boot sectors.....................: D:,
          Scan memory......................: on
          Process scan.....................: on
          Scan registry....................: on
          Search for rootkits..............: on
          Scan all files...................: All files
          Scan archives....................: on
          Recursion depth..................: 20
          Smart extensions.................: on
          Macro heuristic..................: on
          File heuristic...................: high

          Start of the scan: 2008-03-27 09:26

          Starting search for hidden objects.
          '61491' objects were checked, '0' hidden objects were found.

          The scan of running processes will be started
          Scan process 'avscan.exe' - '1' Module(s) have been scanned
          Scan process 'avcenter.exe' - '1' Module(s) have been scanned
          Scan process 'WOOBrowser.exe' - '1' Module(s) have been scanned
          Scan process 'DownloadManager.exe' - '1' Module(s) have been scanned
          Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
          Scan process 'Watch.exe' - '1' Module(s) have been scanned
          Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
          Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
          Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned
          Scan process 'Toaster.exe' - '1' Module(s) have been scanned
          Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
          Scan process 'ComComp.exe' - '1' Module(s) have been scanned
          Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
          Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
          Scan process 'alg.exe' - '1' Module(s) have been scanned
          Scan process 'RocketDock.exe' - '1' Module(s) have been scanned
          Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
          Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
          Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
          Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
          Scan process 'oaui.exe' - '0' Module(s) have been scanned
          Scan process 'avgnt.exe' - '1' Module(s) have been scanned
          Scan process 'HOMERunner.exe' - '1' Module(s) have been scanned
          Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
          Scan process 'hpztsb12.exe' - '1' Module(s) have been scanned
          Scan process 'UnlockerAssistant.exe' - '1' Module(s) have been scanned
          Scan process 'realsched.exe' - '1' Module(s) have been scanned
          Scan process 'WinPatrol.exe' - '1' Module(s) have been scanned
          Scan process 'qttask.exe' - '1' Module(s) have been scanned
          Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
          Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned
          Scan process 'ps2.EXE' - '1' Module(s) have been scanned
          Scan process 'jusched.exe' - '1' Module(s) have been scanned
          Scan process 'svchost.exe' - '1' Module(s) have been scanned
          Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
          Scan process 'CDAC11BA.EXE' - '1' Module(s) have been scanned
          Scan process 'sched.exe' - '1' Module(s) have been scanned
          Scan process 'avguard.exe' - '1' Module(s) have been scanned
          Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
          Scan process 'explorer.exe' - '1' Module(s) have been scanned
          Scan process 'oasrv.exe' - '0' Module(s) have been scanned
          Scan process 'svchost.exe' - '1' Module(s) have been scanned
          Scan process 'svchost.exe' - '1' Module(s) have been scanned
          Scan process 'svchost.exe' - '1' Module(s) have been scanned
          Scan process 'svchost.exe' - '1' Module(s) have been scanned
          Scan process 'svchost.exe' - '1' Module(s) have been scanned
          Scan process 'lsass.exe' - '1' Module(s) have been scanned
          Scan process 'services.exe' - '1' Module(s) have been scanned
          Scan process 'winlogon.exe' - '1' Module(s) have been scanned
          Scan process 'csrss.exe' - '1' Module(s) have been scanned
          Scan process 'smss.exe' - '1' Module(s) have been scanned
          49 processes with 49 modules were scanned

          Starting master boot sector scan:
          Master boot sector HD0
          [NOTE] No virus was found!
          Master boot sector HD1
          [NOTE] No virus was found!
          [WARNING] The boot sector file could not be read!
          [WARNING] Error code: 0x0015
          Master boot sector HD2
          [NOTE] No virus was found!
          [WARNING] The boot sector file could not be read!
          [WARNING] Error code: 0x0015
          Master boot sector HD3
          [NOTE] No virus was found!
          [WARNING] The boot sector file could not be read!
          [WARNING] Error code: 0x0015
          Master boot sector HD4
          [NOTE] No virus was found!
          [WARNING] The boot sector file could not be read!
          [WARNING] Error code: 0x0015

          Start scanning boot sectors:
          Boot sector 'C:\'
          [NOTE] No virus was found!
          Boot sector 'D:\'
          [NOTE] No virus was found!

          Starting to scan the registry.
          The registry was scanned ( '51' files ).

          Starting the file scan:

          Begin scan in 'C:\' <HP_PAVILION>
          C:\pagefile.sys
          [WARNING] The file could not be opened!
          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228780.exe
          [DETECTION] Contains suspicious code HEUR/Malware
          [INFO] The file was moved to '481d7b9e.qua'!
          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229029.exe
          [DETECTION] Contains suspicious code HEUR/Malware
          [INFO] The file was moved to '481d7bb0.qua'!
          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229132.exe
          [DETECTION] Contains suspicious code HEUR/Malware
          [INFO] The file was moved to '481d7bbe.qua'!
          C:\WINDOWS\system32\drivers\OADriver.sys
          [WARNING] The file could not be opened!
          C:\WINDOWS\system32\drivers\OAmon.sys
          [WARNING] The file could not be opened!
          C:\WINDOWS\system32\drivers\oanet.sys
          [WARNING] The file could not be opened!
          Begin scan in 'D:\' <HP_RECOVERY>

          End of the scan: 2008-03-27 12:09
          Used time: 2:42:36 min

          The scan has been done completely.

          6764 Scanning directories
          474509 Files were scanned
          0 viruses and/or unwanted programs were found
          3 Files were classified as suspicious:
          0 files were deleted
          0 files were repaired
          3 files were moved to quarantine
          0 files were renamed
          4 Files cannot be scanned
          474509 Files not concerned
          14843 Archives were scanned
          4 Warnings
          13 Notes
          61491 Objects were scanned with rootkit scan
          0 Hidden objects were found

          a par ca tout est redevenu normal voir meme un peu plus rapide pour l'ouverture des applications
          encore merci pour le temps consacre et ton aide.
      2. g!rly Contributeur
        xavier,

        oui il a trouvé quelque chose dans la restoration system; on rectifira ca la fin...

        encore un dernier scan en ligne cette fois ci; pour verifier :

        Scan en ligne bitdefender :

        https://www.bitdefender.com/toolbox/

        Clicker sur " I agree " et suivre les indications

        A faire imperativement sous internet explorer, en acceptant l´activ x

        tutoriel en image en image

        http://pageperso.aol.fr/rginformatique/mapage/defender.htm

        post le rapport stp

        @+
        1. xavierf1518 Auteur
          voila le rapport bitdefender:
          BitDefender Online Scanner

          Scan report generated at: Thu, Mar 27, 2008 - 20:31:29

          Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;

          Statistics

          Time
          01:08:38

          Files
          450206

          Folders
          6795

          Boot Sectors
          3

          Archives
          15552

          Packed Files
          17365

          Results

          Identified Viruses
          6

          Infected Files
          69

          Suspect Files
          0

          Warnings
          0

          Disinfected
          0

          Deleted Files
          69

          Engines Info

          Virus Definitions
          1034431

          Engine build
          AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

          Scan plugins
          16

          Archive plugins
          41

          Unpack plugins
          7

          E-mail plugins
          6

          System plugins
          5

          Scan Settings

          First Action
          Disinfect

          Second Action
          Delete

          Heuristics
          Yes

          Enable Warnings
          Yes

          Scanned Extensions
          *;

          Exclude Extensions

          Scan Emails
          Yes

          Scan Archives
          Yes

          Scan Packed
          Yes

          Scan Files
          Yes

          Scan Boot
          Yes

          Scanned File
          Status

          C:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe
          Infected with: Trojan.Downloader.Bagle.HA

          C:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe
          Deleted

          C:\Program Files\programmes\CloneCD\clone cd et crack\Crack clone cd\CloneCD v4 kg.exe
          Infected with: Packer.FSG.A

          C:\Program Files\programmes\CloneCD\clone cd et crack\Crack clone cd\CloneCD v4 kg.exe
          Disinfection failed

          C:\Program Files\programmes\CloneCD\clone cd et crack\Crack clone cd\CloneCD v4 kg.exe
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0006
          Detected with: Adware.Navipromo.BYH

          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0006
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)
          Update failed

          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0014=>(NSIS g)=>lzma_solid_nsis0002
          Detected with: Adware.Navipromo.BYH

          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0014=>(NSIS g)=>lzma_solid_nsis0002
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0014=>(NSIS g)
          Update failed

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\104546.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\104546.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\105718.exe.vir
          Infected with: Win32.Bagle.STX@mm

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\105718.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\118703.exe.vir
          Infected with: Win32.Bagle.STX@mm

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\118703.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14639109.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14639109.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14684156.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14684156.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14709156.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14709156.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\29244500.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\29244500.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\43735421.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\43735421.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\43827765.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\43827765.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\633796.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\633796.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\72898218.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\72898218.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\72973250.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\72973250.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\82890.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\82890.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\85234.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\85234.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\87516687.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\87516687.exe.vir
          Deleted

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\97046.exe.vir
          Infected with: Trojan.Pakes.ZUS

          C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\97046.exe.vir
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP881\A0227637.exe
          Infected with: Trojan.Downloader.Bagle.HA

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP881\A0227637.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228710.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228710.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228745.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228745.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228770.exe
          Infected with: Trojan.Downloader.Bagle.HA

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228770.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228775.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228775.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228775.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228777.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228777.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228777.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228787.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228787.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228787.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228821.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228821.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228881.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228881.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP882\A0228881.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0228971.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0228971.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0228995.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0228995.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229019.exe
          Infected with: Trojan.Downloader.Bagle.HA

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229019.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229024.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229024.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229024.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229026.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229026.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229026.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229065.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229065.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229129.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229129.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229129.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229131.exe
          Infected with: Packer.Krunchy.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229131.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP883\A0229131.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229445.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229445.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229528.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229528.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229593.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229593.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229636.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229636.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229660.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229660.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229683.exe
          Infected with: Trojan.Downloader.Bagle.HA

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229683.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229719.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP886\A0229719.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0229844.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0229844.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0229927.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0229927.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0229992.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0229992.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230035.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230035.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230059.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230059.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230082.exe
          Infected with: Trojan.Downloader.Bagle.HA

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230082.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230118.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP887\A0230118.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231339.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231339.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231341.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231341.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231376.exe
          Infected with: Win32.Bagle.STX@mm

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231376.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231404.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231404.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231412.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231412.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231431.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231431.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231611.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231611.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231677.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231677.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231687.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231687.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231753.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231753.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231772.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231772.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231782.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231782.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231812.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231812.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231814.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231814.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231818.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231818.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231848.exe
          Infected with: Trojan.Pakes.ZUS

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP888\A0231848.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP901\A0232255.exe
          Infected with: Trojan.Downloader.Bagle.HA

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP901\A0232255.exe
          Deleted

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP901\A0232256.exe
          Infected with: Packer.FSG.A

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP901\A0232256.exe
          Disinfection failed

          C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP901\A0232256.exe
          Deleted
      3. g!rly Contributeur
        ok xavier,

        fais ceci :

        Désactive ta restauration système:
        pour cela :
        Click droit sur poste de travail, dans l´arborescence sur propriétés;
        dans la nouvelle fenettre click sur l´onglet restauration système;
        coche la case désactiver la restauration systèm et applique.
        puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés;
        dans la nouvelle fenettre click sur l´onglet restauration systèm
        décoche la case désactiver la restauration systèm et applique.

        puis

        Télécharge ToolsCleaner sur ton bureau.
        --> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
        # Clique sur Recherche et laisse le scan agir ...
        # Clique sur Suppression pour finaliser.
        # Tu peux, si tu le souhaites, te servir des Options facultatives.
        # Clique sur Quitter pour obtenir le rapport.
        # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

        @+
        1. xavierf1518 Auteur
          voila le rapport:
          -->- Recherche:

          C:\Qoobox: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
          C:\Documents and Settings\HP_Propriétaire\Bureau\HijackThis.lnk: trouvé !
          C:\Documents and Settings\HP_Propriétaire\Mes documents\Mes fichiers reçus\HJTInstall.exe: trouvé !
          C:\Program Files\Trend Micro\HijackThis: trouvé !
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

          ---------------------------------
          -->- Suppression:

          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
          C:\Documents and Settings\HP_Propriétaire\Bureau\HijackThis.lnk: supprimé !
          C:\Documents and Settings\HP_Propriétaire\Mes documents\Mes fichiers reçus\HJTInstall.exe: supprimé !
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
          C:\Qoobox: supprimé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
          C:\Program Files\Trend Micro\HijackThis: supprimé !

          Corbeille vidée!
          Fichiers temporaires nettoyés !
          1. g!rly Contributeur
            ok xavier,

            plus de crack maintenant !

            bonne continuation`

            Bye`

            g!rly`
            1. xavierf1518 Auteur
              ok ca marche, je te remercie pour ton aide.
              bonne continuation a toi aussi.

              Discussions similaires

              Iptv beug
              leogauthier15

              1 réponse
              Smart IPTV met un temps fou à charger depuis que je suis passé à la fibre
              Ancaro13

              3 réponses
              Scrabble go : mot inexistant
              Famaszer

              3 réponses
              Problème iptv boîtier
              Joaurep

              2 réponses
              Wannonce : impossible de se connecter
              Clokit

              2 réponses