virus : reported insecure browsing Résolu

Question

Bonjour,
j'utilise internet explorer 7.0 et à chaque fois que j'utilise mon navigateur et que je tappe le nom d'un moteur de recherche j'ai ce message d'erreur qui s'affiche
Insecure Internet activity. Threat of virus attack 
Due to insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes. 
Also insecure Internet activity can result in revealing your personal information. 
To get full advanced real-time protection for PC and Internet activity, register KvmSecure. 
We recommend you to protect your PC now and continue safe Internet browsing. 
Click here to get full advanced real-time protection and continue browsing. 
Continue to this website unprotected (not recommended).

mon fond d'ecran est devenu bleu et il y a un message d'erreur d'ecrit qui dit : warning , spyware detected on your computer
j'ai pourtant kaspersky comme anti virus et j'ai fait une analyse avec spybot
quelqun pourrait il me guider pour l'analyse hijackthis ??

benurrr · Answer

salut fait un scan complet avec malwarbyte http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware  a l'installation tu coche mise a jour et lançement du programme et poste le rapport

a.M · Answer

malware est en cour d'execution je posterais le rapport des que je finis
ca ne cesse de s'agraver puisque je ne retrouve plus mes disques locaux et que virus alert est marqué devant l'horloge

laYS · Answer

voici mon résultat du test malwarebytes



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc7a758b-8ca3-4fb5-987d-f6147daa28c6} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\atfxqogp.bxpr (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\atfxqogp.toolbar.1 (Trojan.FakeAlert) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysSetup (Trojan.Clicker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ChkSetup (Trojan.Clicker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\KernelAlrt (Trojan.Clicker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{99972d1b-964e-49ec-92f4-1eb39f4810a5} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{0b9928ca-2b38-43c8-be19-a4a6386de417} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\OriginalWallpaper (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\ConvertedWallpaper (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\SCRNSAVE.EXE (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advap32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vltdfabw (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vregfwlx (Trojan.FakeAlert) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-643-9914694-23737) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (92318-600-9914694-23737) -> No action taken.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> No action taken.

Dossier(s) infecté(s):
C:\WINDOWS\system32\673351 (Trojan.BHO) -> No action taken.
C:\WINDOWS\system32\818646 (Trojan.BHO) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\Resources\SysSetup.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\Resources\ChkSetup.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\Resources\KernelAlrt.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\system32\blackster.scr (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\byXRkkkj.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ddcaayvW.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ddcCULcd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\geBtQgGA.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\geBtSJdB.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\urqopmLB.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\urqQkjkk.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\xxyaxWMC.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\User\Local Settings\Tempbnpsrv.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\khfDvVLC.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\xmpstean.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\boqnrwdmfrp.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\printsrv32.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp
yps4.exe (Trojan.Agent) -> No action taken.

laYS · Answer

j'ai pas tout copié dsl


Malwarebytes' Anti-Malware 1.14
Version de la base de données: 800

12:12:17 30/05/2008
mbam-log-5-30-2008 (12-12-13).txt

Type de recherche: Examen rapide
Eléments examinés: 53372
Temps écoulé: 10 minute(s), 4 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 5
Clé(s) du Registre infectée(s): 25
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 26

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\Resources\SysSetup.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\Resources\ChkSetup.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\Resources\KernelAlrt.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\boqnrwdmfrp.dll (Trojan.FakeAlert) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{df5bd84e-c13f-4b06-8395-f9be408652eb} (Trojan.Clicker) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{bae42be9-6097-4e4c-86be-21dca22cfb22} (Trojan.Clicker) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cd97a9d3-3ce3-44d7-8fab-762b02369aa4} (Trojan.Clicker) -> No action taken.
HKEY_CLASSES_ROOT\e405.e405mgr (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\e405.e405mgr.1 (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{54192079-8e8a-43d8-bcbc-3874916159af} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54192079-8e8a-43d8-bcbc-3874916159af} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{570ee2a3-039b-4e5f-ae6a-d7949f9d356b} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{570ee2a3-039b-4e5f-ae6a-d7949f9d356b} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{99972d1b-964e-49ec-92f4-1eb39f4810a5} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99972d1b-964e-49ec-92f4-1eb39f4810a5} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0b9928ca-2b38-43c8-be19-a4a6386de417} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0b9928ca-2b38-43c8-be19-a4a6386de417} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\e405.e405mgr (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\e405.e405mgr.1 (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winctrl32 (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cc7a758b-8ca3-4fb5-987d-f6147daa28c6} (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc7a758b-8ca3-4fb5-987d-f6147daa28c6} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\atfxqogp.bxpr (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\atfxqogp.toolbar.1 (Trojan.FakeAlert) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysSetup (Trojan.Clicker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ChkSetup (Trojan.Clicker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\KernelAlrt (Trojan.Clicker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{99972d1b-964e-49ec-92f4-1eb39f4810a5} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{0b9928ca-2b38-43c8-be19-a4a6386de417} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\OriginalWallpaper (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\ConvertedWallpaper (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\SCRNSAVE.EXE (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advap32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vltdfabw (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vregfwlx (Trojan.FakeAlert) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-643-9914694-23737) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (92318-600-9914694-23737) -> No action taken.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> No action taken.

Dossier(s) infecté(s):
C:\WINDOWS\system32\673351 (Trojan.BHO) -> No action taken.
C:\WINDOWS\system32\818646 (Trojan.BHO) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\Resources\SysSetup.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\Resources\ChkSetup.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\Resources\KernelAlrt.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\system32\blackster.scr (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\byXRkkkj.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ddcaayvW.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ddcCULcd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\geBtQgGA.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\geBtSJdB.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\urqopmLB.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\urqQkjkk.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\xxyaxWMC.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\User\Local Settings\Tempbnpsrv.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\khfDvVLC.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\xmpstean.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\boqnrwdmfrp.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\printsrv32.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\User\Local Settings\Temp
yps4.exe (Trojan.Agent) -> No action taken.

laYS · Answer

on me dit no files were found !!

laYS · Answer

vundofix ne me trouve rien
quand au scan détaillé dé malware le voici en mode sans echec


lwarebytes' Anti-Malware 1.14
Version de la base de données: 800

13:08:58 30/05/2008
mbam-log-5-30-2008 (13-08-58).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 67570
Temps écoulé: 8 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 25
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 28

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\e405.e405mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\e405.e405mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54192079-8e8a-43d8-bcbc-3874916159af} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54192079-8e8a-43d8-bcbc-3874916159af} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{570ee2a3-039b-4e5f-ae6a-d7949f9d356b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{570ee2a3-039b-4e5f-ae6a-d7949f9d356b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{99972d1b-964e-49ec-92f4-1eb39f4810a5} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99972d1b-964e-49ec-92f4-1eb39f4810a5} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b9928ca-2b38-43c8-be19-a4a6386de417} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0b9928ca-2b38-43c8-be19-a4a6386de417} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bae42be9-6097-4e4c-86be-21dca22cfb22} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cd97a9d3-3ce3-44d7-8fab-762b02369aa4} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{df5bd84e-c13f-4b06-8395-f9be408652eb} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\e405.e405mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\e405.e405mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winctrl32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cc7a758b-8ca3-4fb5-987d-f6147daa28c6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc7a758b-8ca3-4fb5-987d-f6147daa28c6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\atfxqogp.bxpr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\atfxqogp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{99972d1b-964e-49ec-92f4-1eb39f4810a5} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{0b9928ca-2b38-43c8-be19-a4a6386de417} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ChkSetup (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\KernelAlrt (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysSetup (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\OriginalWallpaper (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\ConvertedWallpaper (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\SCRNSAVE.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advap32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vltdfabw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vregfwlx (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-643-9914694-23737) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (92318-600-9914694-23737) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\673351 (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\818646 (Trojan.BHO) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\User\Local Settings\Tempbnpsrv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AC779E17-2CCA-455A-8580-37D33B791008}\RP3\A0000010.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Resources\ChkSetup.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\Resources\KernelAlrt.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\Resources\SysSetup.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blackster.scr (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\byXRkkkj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddcaayvW.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddcCULcd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\geBtQgGA.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\geBtSJdB.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqopmLB.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqQkjkk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyaxWMC.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\khfDvVLC.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\xmpstean.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\boqnrwdmfrp.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp\printsrv32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN22.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temp
yps4.exe (Trojan.Agent) -> Quarantined and deleted successfully.


merci encore pour ton aide

laYS · Answer

je dois aussi signaler une anomalie au niveau de mon post de travail ou je ne retrouve plus mes disque locaux(c;d)
j'y accede en executant c :/ dans le menu démarrer

laYS · Answer

up

a.M · Answer

j'ai en effet supprimé les infections trouvées par malware
je poste le rapport squareed des ke je finis

a.M · Answer

est ce normal que je ne puisse pas me connecter en mode sans echec ( meme si j'ai activé la connexion réseau au démarrage)

a.M · Answer

voici mon rapport a2scan


Version - a-squared Free 3.5
Dernière mise à jour : 30/05/2008 14:08:56

Paramètres des balayages :

Éléments : Mémoire, Traces, Cookies, C:\, D:\
Balaye dans les archives : Marche
Analyse heuristique : Marche
Balaye dans les ADS : Marche

Début du balayage :	30/05/2008 14:36:52

Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AlertStyle(0) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AppearOfflineHotKey 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AppearOfflineModifier 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AwayHotKey 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AwayModifier 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> BusyHotKey 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> BusyModifier 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> ClipboardHotKey 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> ClipboardModifier 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> CloseAlert(0) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> elO(0) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> GroupChoice 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> OnlineHotKey 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> OnlineModifier 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> OpenSensitivity(0) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup0 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup1 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup10 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup2 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup3 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup4 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup5 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup6 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup7 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup8 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup9 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> RSOTime 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(13) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(2) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(22) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(37) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(44) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(7) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Slider 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Slider1 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> SpeechSpeed 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> SpeechVolume 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Time_Format 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(1) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(11) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(16) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(6) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(9) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MDLCap 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> Menu1 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> Menu2 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(0) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(1) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(2) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(3) 	Objets détectés : Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> WLMCaption 	Objets détectés : Trace.Registry.DiscoveryLive
Key: HKEY_CURRENT_USER\software\install 	Objets détectés : Trace.Registry.AdClicker
Value: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run --> ares 	Objets détectés : Trace.Registry.Ares
C:\Documents and Settings\User\Cookies\user@advertising[1].txt 	Objets détectés : Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@atdmt[1].txt 	Objets détectés : Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@commentcamarche[1].txt 	Objets détectés : Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt 	Objets détectés : Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@specificclick[2].txt 	Objets détectés : Trace.TrackingCookie

Analysé

Fichiers : 	45010
Traces : 	182458
Cookies : 	53
Processus : 	12

Objets trouvés

Fichiers : 	0
Traces : 	53
Cookies : 	5
Processus : 	0
Clés de Registre : 	0

Fin du balayage :	30/05/2008 14:49:55
Temps du balayage :	0:13:03

C:\Documents and Settings\User\Cookies\user@advertising[1].txt	Quarantaine Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@atdmt[1].txt	Quarantaine Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@commentcamarche[1].txt	Quarantaine Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt	Quarantaine Trace.TrackingCookie
C:\Documents and Settings\User\Cookies\user@specificclick[2].txt	Quarantaine Trace.TrackingCookie
Value: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run --> ares	Quarantaine Trace.Registry.Ares
Key: HKEY_CURRENT_USER\software\install	Quarantaine Trace.Registry.AdClicker
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AlertStyle(0)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AppearOfflineHotKey	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AppearOfflineModifier	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AwayHotKey	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> AwayModifier	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> BusyHotKey	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> BusyModifier	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> ClipboardHotKey	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> ClipboardModifier	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> CloseAlert(0)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> elO(0)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> GroupChoice	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> OnlineHotKey	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> OnlineModifier	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> OpenSensitivity(0)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup0	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup1	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup10	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup2	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup3	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup4	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup5	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup6	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup7	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup8	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Popup9	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> RSOTime	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(13)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(2)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(22)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(37)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(44)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Setting(7)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Slider	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Slider1	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> SpeechSpeed	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> SpeechVolume	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live\Settings --> Time_Format	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(1)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(11)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(16)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(6)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> GlobalSetting(9)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MDLCap	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> Menu1	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> Menu2	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(0)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(1)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(2)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> MouseGesture(3)	Quarantaine Trace.Registry.DiscoveryLive
Value: HKEY_CURRENT_USER\Software\Matt Holwood\MessengerDiscovery Live --> WLMCaption	Quarantaine Trace.Registry.DiscoveryLive

Quarantaine

Fichiers : 	0
Traces : 	53
Cookies : 	5

Utilisateur anonyme · Answer

Bonjours tout le monde

suite a la demande en mp de LaYS


laYS :


Télécharge HijackThis ici : 

-> https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html

Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation) 

-> http://pageperso.aol.fr/balltrap34/Hijenr.gif 

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation) 

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm 

Post le rapport généré ici stp...

a.M · Answer

voici mon resultat hijackthis en attendant de telecharger l'antivirus

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:12:29, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Documents and Settings\User\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0B9928CA-2B38-43C8-BE19-A4A6386DE417} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {41032A04-F693-4D0B-A251-8CF28A2210CC} - C:\WINDOWS\system32\wvUljIaW.dll (file missing)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54192079-8E8A-43D8-BCBC-3874916159AF} - (no file)
O2 - BHO: (no name) - {570EE2A3-039B-4E5F-AE6A-D7949F9D356B} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {99972D1B-964E-49EC-92F4-1EB39F4810A5} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {CC7A758B-8CA3-4FB5-987D-F6147DAA28C6} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: atfxqogp - {23649E36-60C6-4433-880A-9DF59FC27342} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Gainward] C:\Program Files\XpertVision\TBPanel.exe /A
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\User\LOCALS~1\Temp\rbnpsrv.exe/r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{94D9AA5F-2EEF-418B-8646-76AA128D016E}: NameServer = 193.251.169.165 196.20.77.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O17 - HKLM\System\CS2\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: ljJDwTKE - ljJDwTKE.dll (file missing)
O20 - Winlogon Notify: mlJYQGvU - C:\WINDOWS\
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\
O21 - SSODL: SysSetup - {df5bd84e-c13f-4b06-8395-f9be408652eb} - (no file)
O21 - SSODL: vltdfabw - {75F2813F-E26C-4085-B9D7-8D9EF835579B} - C:\WINDOWS\vltdfabw.dll (file missing)
O21 - SSODL: vregfwlx - {0449BD2C-CF2A-4CC4-B1B2-49A8DC58AFCF} - C:\WINDOWS\vregfwlx.dll (file missing)
O21 - SSODL: ChkSetup - {bae42be9-6097-4e4c-86be-21dca22cfb22} - (no file)
O21 - SSODL: KernelAlrt - {cd97a9d3-3ce3-44d7-8fab-762b02369aa4} - (no file)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

Utilisateur anonyme · Answer

laisse l antivirus de coté pour l instant ( d ailleurs le tient est tres bien)


Télécharge sur le bureau http://siri.urz.free.fr/Fix/SmitfraudFix.exe 
=> Double clic sur SmitfraudFix

=> Choisir Option 1 
=> poste le rapport

a.M · Answer

le lien ne marche pas chez moi ;-( , je vais essayer de le telecharger ailleurs

Utilisateur anonyme · Answer

question : t habites en algérie ????

a.M · Answer

yess!! ca pourrait ne pas marcher chez moi ?

Utilisateur anonyme · Answer

si si c était pour savoir au cas ou .....

Utilisateur anonyme · Answer

essai ici :


http://www.revioo.com/download/dld95.html

a.M · Answer

voila je l'ai eu à une autre adresse
voici le rapport
SmitFraudFix v2.323

Rapport fait à 15:38:27,18, 30/05/2008
Executé à partir de C:\Documents and Settings\User\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\User


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\User\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\User\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 193.251.169.165
DNS Server Search Order: 196.20.77.165

Description: Carte Fast Ethernet compatible VIA #2 - Miniport d'ordonnancement de paquets
DNS Server Search Order: 196.20.77.165

HKLM\SYSTEM\CCS\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer=196.20.77.165
HKLM\SYSTEM\CCS\Services\Tcpip\..\{94D9AA5F-2EEF-418B-8646-76AA128D016E}: NameServer=193.251.169.165 196.20.77.165
HKLM\SYSTEM\CS1\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer=196.20.77.165
HKLM\SYSTEM\CS1\Services\Tcpip\..\{94D9AA5F-2EEF-418B-8646-76AA128D016E}: NameServer=193.251.169.165 196.20.77.165
HKLM\SYSTEM\CS2\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer=196.20.77.165
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

Télécharge clean.zip, de Malekal 
http://www.malekal.com/download/clean.zip 

comment l'utiliser 
Tuto 
http://mickael.barroux.free.fr/securite/clean.php 

(1) Dézippe-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean. 

(2) Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd 

une fenêtre noire va apparaître pendant un instant, laisse la ouverte. 

(3) Choisis l'option 1 puis patiente 
Poste le rapport obtenu 


pour retrouver le rapport : double clique sur > C > double clique sur " rapport_clean txt. 
et copie/colle le sur ta prochaine réponse . 

Ne passe pas à l'option 2 sans notre avis !

a.M · Answer

est ce normal de n'avoir que ca dans le rapport ?
 30/05/2008 a 15:55:44,68 
 
*** Recherche des fichiers dans C: 
C:\autorun.inf FOUND 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
C:\WINDOWS\system32\mcrh.tmp FOUND 
 
*** Recherche des fichiers dans C:\Program Files

Utilisateur anonyme · Answer

-> Redémarre en mode sans échec : 

Comment redémarrer en mode sans echec? 

Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter. 
Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal! 
Ps : si F8 ne marche pas utilise la touche F5. 

-> Tuto : http://forum.telecharger.01net.com/forum/ 

-> Une fois en mode sans echec, ouvre le dossier que tu auvais crée et click sur clean.cmd et choisis l'option 2. 

-> Redémarre normalement et poste le rapport de clean + un rapport hijackthis fais apres passage de clean option 2

Utilisateur anonyme · Answer

RE BENURR


pour les ip 

exemple prend cette lihne 17 hijackthis :

O17 - HKLM\System\CCS\Services\Tcpip\..\{94D9AA5F-2EEF-418B-8646-76AA128D016E}: NameServer = 193.251.169.165 196.20.77.165 

l ip est la : 196.20.77.165

tu la test la : http://whois.geektools.com/whois.php

a.M · Answer

2ieme rapport clean
Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 30/05/2008 a 16:08:06,06 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
 
*** Suppression des fichiers dans C:\Program Files 
 
*** Suppression des clefs du registre effectuee.. 

rapport hijachthis apres clean


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:09:12, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\User\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0B9928CA-2B38-43C8-BE19-A4A6386DE417} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {41032A04-F693-4D0B-A251-8CF28A2210CC} - C:\WINDOWS\system32\wvUljIaW.dll (file missing)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54192079-8E8A-43D8-BCBC-3874916159AF} - (no file)
O2 - BHO: (no name) - {570EE2A3-039B-4E5F-AE6A-D7949F9D356B} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {99972D1B-964E-49EC-92F4-1EB39F4810A5} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {CC7A758B-8CA3-4FB5-987D-F6147DAA28C6} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: atfxqogp - {23649E36-60C6-4433-880A-9DF59FC27342} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Gainward] C:\Program Files\XpertVision\TBPanel.exe /A
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\User\LOCALS~1\Temp\rbnpsrv.exe/r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O17 - HKLM\System\CS2\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: ljJDwTKE - ljJDwTKE.dll (file missing)
O20 - Winlogon Notify: mlJYQGvU - C:\WINDOWS\
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\
O21 - SSODL: SysSetup - {df5bd84e-c13f-4b06-8395-f9be408652eb} - (no file)
O21 - SSODL: vltdfabw - {75F2813F-E26C-4085-B9D7-8D9EF835579B} - C:\WINDOWS\vltdfabw.dll (file missing)
O21 - SSODL: vregfwlx - {0449BD2C-CF2A-4CC4-B1B2-49A8DC58AFCF} - C:\WINDOWS\vregfwlx.dll (file missing)
O21 - SSODL: ChkSetup - {bae42be9-6097-4e4c-86be-21dca22cfb22} - (no file)
O21 - SSODL: KernelAlrt - {cd97a9d3-3ce3-44d7-8fab-762b02369aa4} - (no file)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

Utilisateur anonyme · Answer

ok on va donner un coup de propre :

réouvre hijackthis 

fais scan only 

coche ces lignes :

O2 - BHO: (no name) - {0B9928CA-2B38-43C8-BE19-A4A6386DE417} - (no file) 

O2 - BHO: (no name) - {54192079-8E8A-43D8-BCBC-3874916159AF} - (no file) 
O2 - BHO: (no name) - {570EE2A3-039B-4E5F-AE6A-D7949F9D356B} - (no file) 
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
O2 - BHO: (no name) - {99972D1B-964E-49EC-92F4-1EB39F4810A5} - (no file) 

O2 - BHO: (no name) - {CC7A758B-8CA3-4FB5-987D-F6147DAA28C6} - (no file) 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 

O20 - Winlogon Notify: ljJDwTKE - ljJDwTKE.dll (file missing) 
O20 - Winlogon Notify: mlJYQGvU - C:\WINDOWS\ 
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\ 
O21 - SSODL: SysSetup - {df5bd84e-c13f-4b06-8395-f9be408652eb} - (no file) 
O21 - SSODL: vltdfabw - {75F2813F-E26C-4085-B9D7-8D9EF835579B} - C:\WINDOWS\vltdfabw.dll (file missing) 
O21 - SSODL: vregfwlx - {0449BD2C-CF2A-4CC4-B1B2-49A8DC58AFCF} - C:\WINDOWS\vregfwlx.dll (file missing) 
O21 - SSODL: ChkSetup - {bae42be9-6097-4e4c-86be-21dca22cfb22} - (no file) 
O21 - SSODL: KernelAlrt - {cd97a9d3-3ce3-44d7-8fab-762b02369aa4} - (no file) 


TU LES COCHES TOUTES ET TU CLIC SUR FIX CHECKED 

ensuite fais ça :



telecharge Ccleaner :

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

instal le sans la barre yahoo 

fais lancer le nettoyage

repete l opération jusqu a ce qu il trouve rien 

ensuite fais registre

fais chercher les erreures 

ensuite fais corriger les erreures 

repete l opération jusqu a ce qu il trouve rien 


ensuite refais un scan hijackthis et poste le rapport stp

a.M · Answer

voila j'ai suivi scrupulusement les instructions

dernier rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:40:42, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Documents and Settings\User\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {41032A04-F693-4D0B-A251-8CF28A2210CC} - (no file)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: (no name) - {23649E36-60C6-4433-880A-9DF59FC27342} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Gainward] C:\Program Files\XpertVision\TBPanel.exe /A
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{94D9AA5F-2EEF-418B-8646-76AA128D016E}: NameServer = 193.251.169.165 196.20.77.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O17 - HKLM\System\CS2\Services\Tcpip\..\{354995C7-8438-4DD3-960C-59CBA617D681}: NameServer = 196.20.77.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

Utilisateur anonyme · Answer

OK C est prfait en fait il te restait une crasse dans les les fichiers temp mais ccleaner l a viré

réouvre hijackthis 
fais scan only 
coche ces lignes :


O2 - BHO: (no name) - {41032A04-F693-4D0B-A251-8CF28A2210CC} - (no file) 

O3 - Toolbar: (no name) - {23649E36-60C6-4433-880A-9DF59FC27342} - (no file) 

et clic sur fix checked 

ensuite désinstal adobe reader acrobat (si c est la version gratuite) et instal cette version fr :

https://get2.adobe.com/reader/otherversions/

ensuite fais ça :


lance reg cleaner pour nettoyer le registre: 


http://manuelsdaide.com/RegCleaner/RegCleaner.htm 
________________ 

ouvre le et clic sur TOOL 

Choisi registry cleanup 

clic sur automatic registry cleaner 

laisse scanner et supprime tout

et pour finir :


* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe 
http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe 

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

a.M · Answer

j'ai du mal a telecharger regleaner , je sais pas ce qui se passe avec download manager

Utilisateur anonyme · Answer

download manager est une M........


Je te conseil de le virer

a.M · Answer

j'ai virré download manager
je viens d'installer regcleaner ,au milieu de l'instalation , un message me dit : error opening file for writing , j'ai fait ignorer
une fois l'installation terminée , quand je clique sur l'icone de démarrage , rien ne se passe

Utilisateur anonyme · Answer

tu l as dezippé ??

a.M · Answer

oui je l'ai dézipé , mais là je viens de cliquer droit , ouvrir en tant que , il s'est ouvert 
j'attends juste le scan

Utilisateur anonyme · Answer

ok

a.M · Answer

mon pc se porte deja beaucoup mieux , fini les messages d'erreurs , les fenetres s'ouvrent normalement et mon arriere plan est redevenu normal
un grand merci à toi

ps : regcleaner est encore en cour d'execution

Utilisateur anonyme · Answer

ok de rien

a.M · Answer

voila je viens d'en finir avec tool cleaner 
voici mon rapport

-->- Recherche: 

C:\Vundofix backups: trouvé !
C:\Documents and Settings\User\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\User\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\User\Bureau\clean	ar.exe: trouvé !
C:\Documents and Settings\User\Bureau\cleanemove.reg: trouvé !
C:\Documents and Settings\User\Bureau\clean\pskill.exe: trouvé !
C:\Documents and Settings\User\Bureau\clean\LFiles.exe: trouvé !
C:\Documents and Settings\User\Bureau\clean\gzip.exe: trouvé !
C:\Documents and Settings\User\Bureau\clean\delsiri.cmd: trouvé !
C:\Documents and Settings\User\Bureau\clean\delr.cmd: trouvé !
C:\Documents and Settings\User\Bureau\clean\del3.cmd: trouvé !
C:\Documents and Settings\User\Bureau\clean\del2.cmd: trouvé !
C:\Documents and Settings\User\Bureau\clean\clean.cmd: trouvé !
C:\Documents and Settings\User\Bureau\clean\cherche.cmd: trouvé !
C:\Documents and Settings\User\Mes documents\Downloads\Compressed\Clean.zip: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\User\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\User\Bureau\clean	ar.exe: supprimé !
C:\Documents and Settings\User\Bureau\cleanemove.reg: supprimé !
C:\Documents and Settings\User\Bureau\clean\pskill.exe: supprimé !
C:\Documents and Settings\User\Bureau\clean\LFiles.exe: supprimé !
C:\Documents and Settings\User\Bureau\clean\gzip.exe: supprimé !
C:\Documents and Settings\User\Bureau\clean\delsiri.cmd: supprimé !
C:\Documents and Settings\User\Bureau\clean\delr.cmd: supprimé !
C:\Documents and Settings\User\Bureau\clean\del3.cmd: supprimé !
C:\Documents and Settings\User\Bureau\clean\del2.cmd: supprimé !
C:\Documents and Settings\User\Bureau\clean\clean.cmd: supprimé !
C:\Documents and Settings\User\Bureau\clean\cherche.cmd: supprimé !
C:\Documents and Settings\User\Mes documents\Downloads\Compressed\Clean.zip: supprimé !
C:\Vundofix backups: supprimé !
C:\Documents and Settings\User\Bureau\SmitFraudfix: supprimé !


par contre j'ai du arretter regcleaner car il buguait

Utilisateur anonyme · Answer

OK C EST propre 

pour remplacer reg cleaner :


telecharge Ccleaner :

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

instal le sans la barre yahoo 

fais lancer le nettoyage

repete l opération jusqu a ce qu il trouve rien 

ensuite fais registre

fais chercher les erreures 

ensuite fais corriger les erreures 

repete l opération jusqu a ce qu il trouve rien 


Si tu es satisfait de mon intervention

et que tu n as plus de probleme 

change le statut du sujet en résolu stp

pour cela va en haut sur ta premiere question et la tu as le choix

a.M · Answer

encore merci , je n'ai pa dormi depuis 48 heure et je suis parti pour faire une nouvelle nuit blanche à bosser
vous faites vraiment du bon boulot

Utilisateur anonyme · Answer

de rien ciao et bon surf 

et bon courage aussi 

apres GROS DODO ............. Ciao

Utilisateur anonyme · Answer

et j oubliai si ça n a pas été fais 

réouvre malewarebyte et vide la quarantaine 

voila ciao @+

LaYS · Answer

je n'ai pa trouvé le moyen de marquer " résolu"  (boulet que je suis)

peut etre est ce du au fait que j'ai changé de pseudoi ?

Utilisateur anonyme · Answer

non en fait tu n es pas enregistré sur le site c est pour ça 


allez ciao @ +

cyracha · Answer

BOnjour meme probleme que précédement... 

j'ai fait le scan avec CLEAN que voici : 


 02/07/2008 a 16:36:29,65 
 
*** Recherche des fichiers dans C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
C:\WINDOWS\AdobeR.exe FOUND 
C:\WINDOWS\sys???????????.exe FOUND 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
 
*** Recherche des fichiers dans C:\Program Files 
*** Fin du rapport ! 

Pourriez vous m'aider aussi? dois-je poursuivre les etapes comme précédement?

cyracha · Answer

BOn je n'ai pu attendre essayant pas moi meme... (je crains le pire :/)

Le rapport de CLean apres l'option 2 (nettoyage) -que j'ai perdu- indisait avoir nettoyer les deux fichiers trouvé : 
C:\WINDOWS\AdobeR.exe FOUND
C:\WINDOWS\sys???????????.exe FOUND 

Quand a mon rapport Hijack le voici : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:01:50, on 02/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\ooVoo\ooVoo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\Program Files\TribalWeb	ribalweb.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpyHunter Security Suite] "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" -scan
O4 - HKLM\..\Run: [6899d3f5] rundll32.exe "C:\WINDOWS\system32\lrrjgmtw.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: TribalWeb.lnk = C:\Program Files\TribalWeb	ribalweb.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://charon777.free.fr/plugins/hardwaredetection_2_0_4_12.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game07.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0AE30453-3106-425B-9DB8-9482816605EB}: NameServer = 80.10.246.2,80.10.246.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{0AE30453-3106-425B-9DB8-9482816605EB}: NameServer = 80.10.246.2,80.10.246.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{0AE30453-3106-425B-9DB8-9482816605EB}: NameServer = 80.10.246.2,80.10.246.129
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

cyracha · Answer

snif... je pensais que vous pourriez m'aider moi aussi... mais rien de grave. je vais tenter tout seul... je n'ai peut etre pas mis les formes... le temps me pressait. bon fin de dimanche a tous...

juliette · Answer

Bonjour, j'avais le même problème et ce peitit soft outre atlantique m'a bien sauvé la mise 
http://www.clubic.com/telecharger-fiche67090-superantispywar­­e-free-edition.html 

Bonne chance à tous

albialboalbu · Answer

Merci beaucoup Juliette!!!

Effectivement, je viens d'avoir le même problème avec "reported internet browser". Etant foncièrement nul en informatique; le parcours du combattant de ci-dessus m'a fait craindre le pire, mais sur ton conseil, j'ai téléchargé Superantispyware --> scan complet de C: et au final 28 trojans et des cookies foireux... mon ordi a une semaine!!! Bref, grand nettoyage de printemps, et désormais ça roule!
Mille mercis à vous tous qui prenez de votre temps pour aider les nuls comme moi !
Bon courage à tous ceux qui galèrent pendant des heures pour réanimer leur portable!

Virus : reported insecure browsing - Page 2

Votre réponse

Discussions similaires

Newsletters