Spyware threat has been detected on your PC

Naokylon -
geoffrey5 Messages postés 14008 Statut Contributeur sécurité - 11 juin 2008 à 21:46

Bonjour,

voici le rappot de SmitFraudFix v2.323

concernant un spyware avec message sur le bureau: Warning: Spyware threat has been detected on your PC

Que dois-je faire ensuite?
Merci

Rapport fait à 8:30:45,90, 11/06/2008
Executé à partir de C:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\R0VN\command.exe
C:\WINDOWS\444.470
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe
C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe
C:\windows\system32\jqwnw64n.exe
C:\Documents and Settings\jcclery.POSTE04\lsass.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterConfig.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
C:\Program Files\3M\PSNotes\psnotes.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\lotus\organize\easyclip.exe
C:\WINDOWS\system32\rcntrkdm.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SYMBIA~1.EXE
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SCBAL.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\accesss.exe PRESENT !
C:\WINDOWS\astctl32.ocx PRESENT !
C:\WINDOWS\avpcc.dll PRESENT !
C:\WINDOWS\clrssn.exe PRESENT !
C:\WINDOWS\cpan.dll PRESENT !
C:\WINDOWS\default.htm PRESENT !
C:\WINDOWS\iexplorer.exe PRESENT !
C:\WINDOWS\loader.exe PRESENT !
C:\WINDOWS\mtwirl32.dll PRESENT !
C:\WINDOWS\notepad32.exe PRESENT !
C:\WINDOWS\olehelp.exe PRESENT !
C:\WINDOWS\systeem.exe PRESENT !
C:\WINDOWS\systemcritical.exe PRESENT !
C:\WINDOWS\time.exe PRESENT !
C:\WINDOWS\users32.exe PRESENT !
C:\WINDOWS\waol.exe PRESENT !
C:\WINDOWS\win32e.exe PRESENT !
C:\WINDOWS\win64.exe PRESENT !
C:\WINDOWS\winajbm.dll PRESENT !
C:\WINDOWS\window.exe PRESENT !
C:\WINDOWS\winmgnt.exe PRESENT !
C:\WINDOWS\x.exe PRESENT !
C:\WINDOWS\xplugin.dll PRESENT !
C:\WINDOWS\xxxvideo.hta PRESENT !
C:\WINDOWS\y.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jcclery.POSTE04

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jcclery.POSTE04\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JCCLER~1.POS\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="sockspy.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\iftuyszv.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 80.10.246.2
DNS Server Search Order: 80.10.246.129

HKLM\SYSTEM\CCS\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer=80.10.246.2,80.10.246.129
HKLM\SYSTEM\CS1\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer=80.10.246.2,80.10.246.129
HKLM\SYSTEM\CS2\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer=80.10.246.2,80.10.246.129

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Configuration: Windows XP
Firefox 2.0.0.14

Afficher la suite

A voir également:

Spyware threat has been detected on your PC
Downloader for pc - Télécharger - Téléchargement & Transfert
Reinitialiser pc - Guide
Temperature pc - Guide
Forcer demarrage pc - Guide
Telecharger clavier arab pc - Télécharger - Divers Web & Internet

4 réponses

Réponse 1 / 4
geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10

Salut !!

Option 2 - Nettoyage :

Redémarrer l'ordinateur en mode sans échec (tapoter F8 au boot pour obtenir le menu de démarrage).

Double cliquer sur smitfraudfix.cmd

Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

Redémarrer en mode normal et poster le rapport.

ensuite :

Télécharge sur le bureau hijackthis : http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

-une fois installé sur le bureau, le renommer scan.exe
-Double-clic dessus
- Clic sur "Do a system scan and save the log"
- copier le rapport, le coller dans la réponse
0
1. naokylon Messages postés 91 Statut Membre
  
  Rapport de smitfraudfix:
  
  SmitFraudFix v2.323
  
  Rapport fait à 13:52:16,79, 11/06/2008
  Executé à partir de C:\SmitfraudFix
  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
  Le type du système de fichiers est NTFS
  Fix executé en mode sans echec
  
  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
  
  »»»»»»»»»»»»»»»»»»»»»»»» hosts
  
  127.0.0.1 localhost
  
  »»»»»»»»»»»»»»»»»»»»»»»» VACFix
  
  VACFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
  
  S!Ri's WS2Fix: LSP not Found.
  
  »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
  
  GenericRenosFix by S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
  
  C:\WINDOWS\accesss.exe supprimé
  C:\WINDOWS\astctl32.ocx supprimé
  C:\WINDOWS\avpcc.dll supprimé
  C:\WINDOWS\clrssn.exe supprimé
  C:\WINDOWS\cpan.dll supprimé
  C:\WINDOWS\default.htm supprimé
  C:\WINDOWS\iexplorer.exe supprimé
  C:\WINDOWS\loader.exe supprimé
  C:\WINDOWS\mtwirl32.dll supprimé
  C:\WINDOWS\notepad32.exe supprimé
  C:\WINDOWS\olehelp.exe supprimé
  C:\WINDOWS\systeem.exe supprimé
  C:\WINDOWS\systemcritical.exe supprimé
  C:\WINDOWS\time.exe supprimé
  C:\WINDOWS\users32.exe supprimé
  C:\WINDOWS\waol.exe supprimé
  C:\WINDOWS\win32e.exe supprimé
  C:\WINDOWS\win64.exe supprimé
  C:\WINDOWS\winajbm.dll supprimé
  C:\WINDOWS\window.exe supprimé
  C:\WINDOWS\winmgnt.exe supprimé
  C:\WINDOWS\x.exe supprimé
  C:\WINDOWS\xplugin.dll supprimé
  C:\WINDOWS\xxxvideo.hta supprimé
  C:\WINDOWS\y.exe supprimé
  
  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
  
  IEDFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
  
  404Fix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer=80.10.246.2,80.10.246.129
  HKLM\SYSTEM\CS1\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer=80.10.246.2,80.10.246.129
  HKLM\SYSTEM\CS2\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer=80.10.246.2,80.10.246.129
  
  »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "System"=""
  
  »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
  
  Nettoyage terminé.
  
  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Reboot
  
  C:\WINDOWS\default.htm supprimé
  C:\WINDOWS\iexplorer.exe supprimé
  
  »»»»»»»»»»»»»»»»»»»»»»»» Fin
  
  0
2. naokylon Messages postés 91 Statut Membre
  
  rapport HiJacjThis:
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:09:52, on 11/06/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\R0VN\command.exe
  C:\WINDOWS\444.470
  C:\Program Files\Network Monitor\netmon.exe
  C:\WINDOWS\portsv.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\iftuyszv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
  C:\Program Files\Softwin\BitDefender9\vsserv.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Logitech\iTouch\iTouch.exe
  C:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
  C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
  C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe
  C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe
  C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
  C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe
  C:\windows\system32\jqwnw64n.exe
  C:\Documents and Settings\jcclery.POSTE04\lsass.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\System32\Rundll32.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\mrofinu1188.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Picasa2\PicasaMediaDetector.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\rcntrkdm.exe
  C:\Program Files\3M\PSNotes\psnotes.exe
  C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
  C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
  C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
  C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
  C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
  C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SYMBIA~1.EXE
  C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SCBAL.exe
  C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
  C:\Documents and Settings\jcclery.POSTE04\Bureau\scan.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
  O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: (no name) - {04F3F2C5-92C7-4F7A-9EA1-1B8BCC7405C8} - C:\WINDOWS\system32\pmnoMCtt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: {60b3c42f-f53d-9d0b-6c74-a199adec4570} - {0754ceda-991a-47c6-b0d9-d35ff24c3b06} - C:\WINDOWS\system32\chjjwmwo.dll
  O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
  O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
  O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
  O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
  O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
  O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
  O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
  O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
  O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
  O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
  O2 - BHO: (no name) - {58AA2AAB-E945-49E7-B7A2-672AC85367E7} - C:\WINDOWS\system32\fccyyXpM.dll
  O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
  O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
  O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
  O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
  O2 - BHO: gooochi browser optimizer - {aa7e1d08-f4c8-4246-9c99-b15d3eae2b27} - C:\WINDOWS\system32\{6b85002e-9f5c-d6d9-e64a-07b9115c8789}.dll
  O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
  O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
  O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
  O2 - BHO: mysidesearch search enhancer - {d8225cf4-98ad-ec4c-fbf8-d6c2ca6bb6e5} - C:\WINDOWS\system32\tsdiivzgno.dll
  O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
  O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
  O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
  O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
  O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
  O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
  O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
  O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
  O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe"
  O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe"
  O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
  O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
  O4 - HKLM\..\Run: [{5F-FD-D4-44-DW}] C:\windows\system32\jqwnw64n.exe DWramFF
  O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\jcclery.POSTE04\lsass.exe
  O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\rcntrkdm.exe DWramFF
  O4 - HKLM\..\Run: [{1c51f085-1a85-c9dc-0abf-7cb6c3911d9c}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{6b85002e-9f5c-d6d9-e64a-07b9115c8789}.dll" DllStart
  O4 - HKLM\..\Run: [bc35fdeb] rundll32.exe "C:\WINDOWS\system32\cwedcyuo.dll",b
  O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257
  O4 - HKLM\..\Run: [BMbf06ce77] Rundll32.exe "C:\WINDOWS\system32\ynkqrolr.dll",s
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [mRouterConfig] "c:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterConfig.exe"
  O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
  O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Logiciel notes Post-it®.lnk = C:\Program Files\3M\PSNotes\psnotes.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer = 80.10.246.2,80.10.246.129
  O20 - Winlogon Notify: fccyyXpM - C:\WINDOWS\SYSTEM32\fccyyXpM.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
  O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\R0VN\command.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
  O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.470.exe (file missing)
  O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
  O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe
  O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
  O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
  
  0
Réponse 2 / 4
Utilisateur anonyme

salut ppur suivre merci
0
Réponse 3 / 4
geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10

ensuite :

Télécharger sur le bureau malware bytes : https://www.besttechie.com/resources/malwarebytes/

= double-clic sur mbam-setup pour lancer l'installation
= Installer simplement sans rien modifier
= Quand le programme lancé ==> cocher Exécuter un examen complet
= Clic Rechercher
= Eventuellement décocher les disque à ne pas analyser
= Clic Lancer l'examen
= En fin de scan , si infection trouvée
==> Clic Afficher résultat
= Fermer vos applications en cours
= Vérifier si tout est coché et clic Supprimer la sélection

un rapport s'ouvre le copier et le coller dans la réponse

Puis redémarrer le pc !!

Et refais un rapport hijackthis

je reviendrai en soirée pour vérifier @+
0
1. naokylon Messages postés 91 Statut Membre
  
  rapport Malwarebytes:
  
  Malwarebytes' Anti-Malware 1.17
  Version de la base de données: 846
  
  14:36:08 11/06/2008
  mbam-log-6-11-2008 (14-36-08).txt
  
  Type de recherche: Examen complet (C:\|)
  Eléments examinés: 83232
  Temps écoulé: 17 minute(s), 49 second(s)
  
  Processus mémoire infecté(s): 8
  Module(s) mémoire infecté(s): 6
  Clé(s) du Registre infectée(s): 53
  Valeur(s) du Registre infectée(s): 9
  Elément(s) de données du Registre infecté(s): 5
  Dossier(s) infecté(s): 2
  Fichier(s) infecté(s): 97
  
  Processus mémoire infecté(s):
  C:\WINDOWS\R0VN\command.exe (AdWare.CommAd) -> Failed to unload process.
  C:\WINDOWS\444.470 (Trojan.DownLoader) -> Unloaded process successfully.
  C:\Program Files\Network Monitor\netmon.exe (Trojan.DNSChanger) -> Unloaded process successfully.
  C:\WINDOWS\portsv.exe (Trojan.Agent) -> Unloaded process successfully.
  C:\WINDOWS\system32\iftuyszv.exe (Trojan.FakeAlert) -> Unloaded process successfully.
  C:\WINDOWS\system32\jqwnw64n.exe (Adware.Agent) -> Unloaded process successfully.
  C:\Documents and Settings\jcclery.POSTE04\lsass.exe (Backdoor.Bot) -> Unloaded process successfully.
  C:\WINDOWS\mrofinu1188.exe (Trojan.Downloader) -> Unloaded process successfully.
  
  Module(s) mémoire infecté(s):
  C:\WINDOWS\system32\cwedcyuo.dll (Trojan.Vundo) -> Unloaded module successfully.
  C:\WINDOWS\system32\pmnoMCtt.dll (Trojan.Vundo) -> Unloaded module successfully.
  C:\WINDOWS\R0VN\asappsrv.dll (AdWare.CommAd) -> Unloaded module successfully.
  C:\WINDOWS\system32\fccyyXpM.dll (Trojan.Vundo) -> Unloaded module successfully.
  C:\WINDOWS\system32\{6b85002e-9f5c-d6d9-e64a-07b9115c8789}.dll (Trojan.Agent) -> Unloaded module successfully.
  C:\WINDOWS\system32\amvo0.dll (Trojan.Agent) -> Unloaded module successfully.
  
  Clé(s) du Registre infectée(s):
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04f3f2c5-92c7-4f7a-9ea1-1b8bcc7405c8} (Trojan.Vundo) -> Delete on reboot.
  HKEY_CLASSES_ROOT\CLSID\{04f3f2c5-92c7-4f7a-9ea1-1b8bcc7405c8} (Trojan.Vundo) -> Delete on reboot.
  HKEY_CLASSES_ROOT\CLSID\{58aa2aab-e945-49e7-b7a2-672ac85367e7} (Trojan.Vundo) -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58aa2aab-e945-49e7-b7a2-672ac85367e7} (Trojan.Vundo) -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fccyyxpm (Trojan.Vundo) -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdservice (AdWare.CommAd) -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdservice (AdWare.CommAd) -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdservice (AdWare.CommAd) -> Delete on reboot.
  HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\Interface\{1e404d48-670a-4085-a6a0-d195793ddd33} (Adware.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\Interface\{9f593aac-ca4c-4a41-a7ff-a00812192d61} (Adware.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\Typelib\{749ec66f-a838-4b38-b8e5-e65d905fff74} (Adware.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\CLSID\{1e404d48-670a-4085-a6a0-d195793ddd33} (Adware.BHO) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3} (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a394e835-c8d6-4b4b-884b-d2709059f3be} (Trojan.Network.Monitor) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcaddc14-bd46-408a-9842-cdbe1c6d37eb} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877c2cd-f137-4144-bdb2-0a811492f920} (Trojan.Downloader) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsSecurity1.209.4 (Trojan.Agent) -> Quarantined and deleted successfully.
  \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gooochi (Trojan.Agent) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\CLSID\{aa7e1d08-f4c8-4246-9c99-b15d3eae2b27} (Trojan.Agent) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{aa7e1d08-f4c8-4246-9c99-b15d3eae2b27} (Trojan.Agent) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Deewoo Network Manager (Adware.Radio) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Network Monitor (Trojan.Service) -> Quarantined and deleted successfully.
  
  Valeur(s) du Registre infectée(s):
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bc35fdeb (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{58aa2aab-e945-49e7-b7a2-672ac85367e7} (Trojan.Vundo) -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{5F-FD-D4-44-DW} (Adware.Agent) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LSA Shellu (Backdoor.Bot) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 (Trojan.Downloader) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{1c51f085-1a85-c9dc-0abf-7cb6c3911d9c} (Trojan.Agent) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amva (Trojan.Agent) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMbf06ce77 (Trojan.Agent) -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExploreUpdSched (Trojan.Agent) -> Quarantined and deleted successfully.
  
  Elément(s) de données du Registre infecté(s):
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnomctt -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\iftuyszv.exe -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnomctt -> Delete on reboot.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
  
  Dossier(s) infecté(s):
  C:\Program Files\Network Monitor (Trojan.DNSChanger) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService\Application Data\NetMon (Trojan.NetMon) -> Quarantined and deleted successfully.
  
  Fichier(s) infecté(s):
  C:\WINDOWS\system32\cwedcyuo.dll (Trojan.Vundo) -> Delete on reboot.
  C:\WINDOWS\system32\ouycdewc.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\pmnoMCtt.dll (Trojan.Vundo) -> Delete on reboot.
  C:\WINDOWS\system32\ttCMonmp.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\ttCMonmp.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\R0VN\asappsrv.dll (AdWare.CommAd) -> Delete on reboot.
  C:\WINDOWS\system32\fccyyXpM.dll (Trojan.Vundo) -> Delete on reboot.
  C:\WINDOWS\R0VN\command.exe (AdWare.CommAd) -> Delete on reboot.
  C:\WINDOWS\444.470 (Trojan.DownLoader) -> Quarantined and deleted successfully.
  C:\Program Files\Network Monitor\netmon.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.
  C:\WINDOWS\portsv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\iftuyszv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\jqwnw64n.exe (Adware.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\jcclery.POSTE04\lsass.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
  C:\WINDOWS\mrofinu1188.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
  C:\WINDOWS\lfn.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\rwwnw64d.exe (Adware.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\xxYPJYsQ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\40541\hL3pars2.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\BE1\simapIP95.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\bip\pllsockt.exe (Adware.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\pin3\gretill5.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\vntiho05\vntiho051080.exe (Trojan.DownLoader) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
  C:\WINDOWS\explore.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\iexplorer.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\x.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\y.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\xxxvideo.hta (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\default.htm (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\svchost32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\loader.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\internet.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\gside.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\winpfz33.sys (Malware.Trace) -> Quarantined and deleted successfully.
  C:\WINDOWS\accesss.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\astctl32.ocx (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\avpcc.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\clrssn.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\cpan.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\ctfmon32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\ctrlpan.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\directx32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\dnsrelay.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\editpad.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\explorer32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\funniest.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\funny.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\gfmnaaa.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\helpcvs.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\iedll.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\inetinf.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\msconfd.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\msspi.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\mssys.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\msupdate.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\mswsc10.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\mswsc20.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\mtwirl32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\notepad32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\olehelp.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\qttasks.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\quicken.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\{6b85002e-9f5c-d6d9-e64a-07b9115c8789}.dll-uninst.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\{6b85002e-9f5c-d6d9-e64a-07b9115c8789}.dll (Trojan.Agent) -> Delete on reboot.
  C:\WINDOWS\system32\amvo.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\amvo0.dll (Trojan.Agent) -> Delete on reboot.
  C:\WINDOWS\system32\ynkqrolr.dll (Trojan.Agent) -> Delete on reboot.
  C:\WINDOWS\system32\rcntrkdm.exe (Trojan.Agent) -> Delete on reboot.
  C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
  C:\WINDOWS\rundll32.vbe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\searchword.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\sistem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\svcinit.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\systeem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\systemcritical.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\time.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\users32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\waol.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\win32e.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\win64.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\winajbm.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\window.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\winmgnt.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\xplugin.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\msnav32.ax (Malware.Trace) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\zxdnt3d.cfg (Malware.Trace) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\atmtd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\atmtd.dll._ (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\rqRLdbxX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\yayaBRLb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
  C:\WINDOWS\uninstall_nmon.vbs (Malware.Trace) -> Quarantined and deleted successfully.
  
  0
2. naokylon Messages postés 91 Statut Membre
  
  rapport HiJackThis (dernier rapport)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:41:58, on 11/06/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\R0VN\command.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Logitech\iTouch\iTouch.exe
  C:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
  C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
  C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe
  C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe
  C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
  C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
  C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterConfig.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
  C:\Program Files\Picasa2\PicasaMediaDetector.exe
  C:\Program Files\3M\PSNotes\psnotes.exe
  C:\Program Files\Softwin\BitDefender9\vsserv.exe
  c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
  C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SYMBIA~1.EXE
  C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SCBAL.exe
  C:\Documents and Settings\jcclery.POSTE04\Bureau\scan.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: {60b3c42f-f53d-9d0b-6c74-a199adec4570} - {0754ceda-991a-47c6-b0d9-d35ff24c3b06} - C:\WINDOWS\system32\chjjwmwo.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: mysidesearch search enhancer - {d8225cf4-98ad-ec4c-fbf8-d6c2ca6bb6e5} - C:\WINDOWS\system32\tsdiivzgno.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
  O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
  O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
  O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe"
  O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe"
  O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
  O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [mRouterConfig] "c:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterConfig.exe"
  O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Logiciel notes Post-it®.lnk = C:\Program Files\3M\PSNotes\psnotes.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{727A662B-B24E-441F-B685-E661A29B1039}: NameServer = 80.10.246.2,80.10.246.129
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
  O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\R0VN\command.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
  O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe (file missing)
  O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
  O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
  
  0
Réponse 4 / 4
geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10

Télécharger sur le Bureau vundofix : http://www.atribune.org/ccount/click.php?id=4

- Double-clic VundoFix.exe.
-Clic Scan for Vundo
- le scan peut être assez long (1à2h) comme très rapide , à la fin
-Clic Fix Vundo
- Puis yes
- Le Bureau disparaît un moment lors de la suppression des fichiers.
-Message shutdown
-clic oui
-Redémarrage auto
Note : il peut y avoir plusieurs redémarrages
-copier le rapport qui est dans C:\vundofix.txt

ensuite :

Télécharger SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double cliquer sur SDFix.exe et choisir Install pour l'extraire dans un dossier dédié sur le Bureau.
> Démarre en mode sans échec : après le bip et avant le logo windows tapoter sur la touche F8 (ou F5): menu M.S.E..
Si problème voir Tuto ici
Choisir son compte, pas celui de l'Administrateur ou autre.

Dérouler la liste des instructions ci-dessous :
• Ouvrir le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuyer sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuyer sur une touche pour redémarrer le PC.
• Le système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuyer sur une touche pour finir l'exécution du script et charger les icônes du Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copier/coller le contenu du fichier Report.txt dans la prochaine réponse sur le forum

Et apres tout ca, refais un rapport hijackthis
0

Spyware threat has been detected on your PC

4 réponses

Discussions similaires

Newsletters