INSECURE INTERNET ACTIVITY

HUGO -  
Bonjour,
DEPUIS PLUSIEURS JOURS EN ME CONECTANT A INTERNET UN MESSAGE ME DISANT INSECURE INTERNET ACTIVITY..................... S'AFFICHE, QUE DOIS JE FAIRE
Configuration: Windows XP
Internet Explorer 7.0

40 réponses

Résumé de la discussion

Un message d’alerte « Insecure Internet Activity » s’affiche après plusieurs jours de connexion sur Windows XP avec Internet Explorer 7.0, et le sujet demande quelles mesures effectuer. Plusieurs éléments explorent des pistes techniques, notamment l’analyse d’un rapport HijackThis, la vérification des programmes au démarrage et l’utilisation d’antivirus, tout en évoquant des composants et extensions potentiellement malveillants. Des questions pratiques évoquent le démarrage en mode sans échec, l’examen des éléments listés par HijackThis et le recours à des outils comme Avast ou Windows Defender pour nettoyer le système. D'autres éléments signalent ne rien trouver de concluant et l’échange se poursuit sans qu’une résolution claire soit proposée, reflétant la nature ouverte du diagnostic et des échanges techniques.

Bobot (l’IA à votre service)
  1. Destrio5 Modérateur
    Salut,

    - Télécharge HijackThis V 2.02 (HijackThis Installer) :
    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

    - Clique sur Install ensuite sur I Accept

    - Clique sur Do a scan system and save log file

    - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
    1. HUGO
      merci davance

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 20:15:49, on 29/06/2008
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16609)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
      C:\Program Files\Alwil Software\Avast4\ashDisp.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Windows\ehome\ehtray.exe
      C:\Windows\System32\p2phost.exe
      C:\Users\Aurélien\AppData\Roaming\Anuman Interactive\AnumanLive\AnumanLive.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      C:\Program Files\Antivirus2008y\antvrs.exe
      C:\Windows\ehome\ehmsas.exe
      C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
      C:\Windows\system32\taskeng.exe
      C:\Windows\system32\taskeng.exe
      C:\Program Files\Internet Explorer\ieuser.exe
      C:\Windows\system32\conime.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
      C:\Windows\system32\SearchFilterHost.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [freebsd.exe] C:\Users\AURLIE~1\AppData\Local\Temp\freebsd.exe
      O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080612
      O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
      O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
      O4 - HKCU\..\Run: [AnumanLive] C:\Users\Aurélien\AppData\Roaming\Anuman Interactive\AnumanLive\AnumanLive.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [Antivirus2008y] C:\Program Files\Antivirus2008y\antvrs.exe
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O16 - DPF: {3AA42713-5C1E-48E2-B432-D8BF420DD31D} - http://virus-scanonline.com/AntvrsInstall.cab
      O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer = 85.255.113.78,85.255.112.36
      O17 - HKLM\System\CCS\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer = 85.255.113.78,85.255.112.36
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.78 85.255.112.36
      O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.78 85.255.112.36
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.78 85.255.112.36
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
      O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
      O23 - Service: Windows Tribute Service - Unknown owner - C:\Windows\system32\kdacq.exe
  2. Destrio5 Modérateur
    ---> Désactive l'UAC le temps de la désinfection :
    https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

    - Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :
    http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/

    - Enregistre-le sur le bureau

    - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

    - Un rapport sera généré, poste-le dans ta prochaine réponse.

    [*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

    ** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix
    1. HUGO
      KAN JE TELECHARGE SMITFRAUDFIX.exe,j'ai selectioné le 1 et apres ^plus rien, j'ai ete redirigé sur le rezo que dois je faire?
  3. Destrio5 Modérateur
    Comment ça ?

    Essaie en mode sans échec :
    https://www.malekal.com/demarrer-windows-mode-sans-echec/
    1. HUGO
      SmitFraudFix v2.328

      Scan done at 20:49:08,30, 29/06/2008
      Run from C:\Users\Aur‚lien\Desktop\SmitfraudFix
      OS: Microsoft Windows [version 6.0.6000] - Windows_NT
      The filesystem type is NTFS
      Fix run in normal mode

      »»»»»»»»»»»»»»»»»»»»»»»» Process

      C:\Windows\system32\csrss.exe
      C:\Windows\system32\wininit.exe
      C:\Windows\system32\csrss.exe
      C:\Windows\system32\services.exe
      C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsm.exe
      C:\Windows\system32\winlogon.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\system32\Ati2evxx.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\SLsvc.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\Ati2evxx.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Windows\System32\spoolsv.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\Dwm.exe
      C:\Windows\system32\taskeng.exe
      C:\Windows\Explorer.EXE
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
      c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
      C:\Program Files\Alwil Software\Avast4\ashDisp.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Windows\ehome\ehtray.exe
      C:\Windows\System32\p2phost.exe
      C:\Users\Aurélien\AppData\Roaming\Anuman Interactive\AnumanLive\AnumanLive.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      C:\Program Files\Antivirus2008y\antvrs.exe
      C:\Windows\ehome\ehmsas.exe
      C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Windows\system32\svchost.exe
      C:\Program Files\CyberLink\Shared Files\RichVideo.exe
      C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\system32\SearchIndexer.exe
      C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      C:\Windows\system32\taskeng.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\cmd.exe
      C:\Windows\system32\conime.exe
      C:\Windows\system32\SearchProtocolHost.exe
      C:\Windows\system32\SearchFilterHost.exe
      C:\Windows\system32\wbem\wmiprvse.exe

      »»»»»»»»»»»»»»»»»»»»»»»» hosts

      »»»»»»»»»»»»»»»»»»»»»»»» C:\

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Aur‚lien

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Aur‚lien\Application Data

      »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\AURLIE~1\FAVORI~1

      C:\Users\AURLIE~1\FAVORI~1\Antivirus Scan.url FOUND !

      »»»»»»»»»»»»»»»»»»»»»»»» Desktop

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

      »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

      »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
      !!!Attention, following keys are not inevitably infected!!!

      IEDFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri

      »»»»»»»»»»»»»»»»»»»»»»»» VACFix
      !!!Attention, following keys are not inevitably infected!!!

      VACFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri

      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
      !!!Attention, following keys are not inevitably infected!!!

      404Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri

      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
      !!!Attention, following keys are not inevitably infected!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
      !!!Attention, following keys are not inevitably infected!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLs"=""
      "LoadAppInit_DLLs"=dword:00000000

      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
      !!!Attention, following keys are not inevitably infected!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "Userinit"="C:\\Windows\\system32\\userinit.exe,"

      »»»»»»»»»»»»»»»»»»»»»»»» Rustock

      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Your computer may be victim of a DNS Hijack: 85.255.x.x detected !

      Description: Intel(R) PRO/Wireless 3945ABG Network Connection
      DNS Server Search Order: 85.255.113.78
      DNS Server Search Order: 85.255.112.36

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: DhcpNameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: DhcpNameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: DhcpNameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer=85.255.113.78,85.255.112.36
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.113.78 85.255.112.36
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.113.78 85.255.112.36
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.113.78 85.255.112.36

      »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

      »»»»»»»»»»»»»»»»»»»»»»»» End
  4. Destrio5 Modérateur
    Bien.

    - Redémarre ton ordinateur en mode sans échec :
    https://blog.sosordi.net/

    - Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée

    - Réponds O(oui) à ces deux questions si elles te sont posées

    Voulez-vous nettoyer le registre ?
    Corriger le fichier infecté ?

    - Un rapport sera généré, sauvegarde-le sur le bureau

    - Redémarre en mode normal

    - Poste le rapport SmitfraudFix et un nouveau rapport HijackThis
    1. HUGO
      j'ai window vista comment redemarrer en mode sans echec? Merci
  6. Destrio5 Modérateur
    http://forum.telecharger.01net.com/forum/high-tech/SECURITE/Securite/redemarrer-mode-echec-sujet_1526_1.htm
    1. HUGO
      desoler je ny arive pas, il ne parle pas de windows vista, comment faire? Meme avec mle lien que tu ma donner ca ne marche pas
    2. HUGO
      COMMENT FAIRE STP
  7. Destrio5 Modérateur
    Vista ou XP même chose.

    Fais le en mode normal alors.
    1. HUGO
      ALORS JE REDEMARE MON ORDI ET APRES JE FAIT KOI?
    2. HUGO
      TU ES LA STP
  8. Destrio5 Modérateur
    Oui, je suis là, je t'ai dit de le faire en mode normal.
    1. HUGO
      SmitFraudFix v2.328

      Scan done at 21:52:41,92, 29/06/2008
      Run from C:\Users\Aur‚lien\Desktop\SmitfraudFix
      OS: Microsoft Windows [version 6.0.6000] - Windows_NT
      The filesystem type is NTFS
      Fix run in normal mode

      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
      !!!Attention, following keys are not inevitably infected!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      »»»»»»»»»»»»»»»»»»»»»»»» Killing process

      »»»»»»»»»»»»»»»»»»»»»»»» hosts

      127.0.0.1 localhost
      ::1 localhost

      »»»»»»»»»»»»»»»»»»»»»»»» VACFix

      VACFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri

      »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

      S!Ri's WS2Fix: LSP not Found.

      »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

      GenericRenosFix by S!Ri

      »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

      C:\Users\AURLIE~1\FAVORI~1\Antivirus Scan.url Deleted

      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

      IEDFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri

      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

      404Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri

      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Description: Intel(R) PRO/Wireless 3945ABG Network Connection
      DNS Server Search Order: 192.168.1.1

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: DhcpNameServer=192.168.1.1

      »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
      !!!Attention, following keys are not inevitably infected!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

      »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

      Registry Cleaning done.

      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
      !!!Attention, following keys are not inevitably infected!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      »»»»»»»»»»»»»»»»»»»»»»»» End
  9. Destrio5 Modérateur
    Ok, tu te débrouilles bien.

    Peux-tu poster un nouveau rapport HijackThis.
    1. HUGO
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:01:34, on 29/06/2008
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16609)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\system32\taskeng.exe
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
      c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
      C:\Program Files\Alwil Software\Avast4\ashDisp.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Windows\ehome\ehtray.exe
      C:\Windows\System32\p2phost.exe
      C:\Users\Aurélien\AppData\Roaming\Anuman Interactive\AnumanLive\AnumanLive.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      C:\Program Files\Antivirus2008y\antvrs.exe
      C:\Windows\ehome\ehmsas.exe
      C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Windows\system32\cmd.exe
      C:\Windows\system32\conime.exe
      C:\Windows\explorer.exe
      C:\Windows\notepad.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [freebsd.exe] C:\Users\Aurélien\AppData\Local\Temp\freebsd.exe
      O4 - HKLM\..\Run: [C:\Windows\system32\kdwhb.exe] C:\Windows\system32\kdwhb.exe
      O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080612
      O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
      O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
      O4 - HKCU\..\Run: [AnumanLive] C:\Users\Aurélien\AppData\Roaming\Anuman Interactive\AnumanLive\AnumanLive.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [Antivirus2008y] C:\Program Files\Antivirus2008y\antvrs.exe
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O16 - DPF: {3AA42713-5C1E-48E2-B432-D8BF420DD31D} - http://virus-scanonline.com/AntvrsInstall.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
      O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
    2. HUGO
      ALORS? TU LA U?
  10. Destrio5 Modérateur
    T'as des infections mais je pense que MAM va les trouver.

    - Télécharge et installe MalwareByte's Anti-Malware :
    http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

    - Mets-le à jour

    - Démarre en mode sans échec :
    https://www.malekal.com/demarrer-windows-mode-sans-echec/

    - Choisis ta session habituelle

    - Fais un scan complet avec MalwareByte's Anti-Malware

    - Supprime tout ce que le logiciel trouve, enregistre le rapport

    - Redémarre en mode normal et poste le rapport ici

    Tutorial :
    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
    1. HUGO
      IMPOSSIBLE NDINSTALLER MALWAREBYTE COMMENT FAIRE STP JE COMMENCE A PETER UN CABLE
    2. HUGO
      je laisse tombe je ny comprend plus rien merci de ta patience slt
  11. Destrio5 Modérateur
    Pardonne-moi, j'ai des problèmes avec Internet en ce moment.

    Que se passe-t-il quand tu installes MAM ?
    1. HUGO
      IMPOSSIBLE DINSTALLER MAM
      UNE FOIS LA PAGE OUVERTE JE NE SAIS PAS OU CLIQUER TOUT EST EN ANGLAIS ET IL NY A PAS DE FENETRE OU C MARQUER INSTALL
      QUE FAIRE?
  12. Destrio5 Modérateur
    https://download.cnet.com/Malwarebytes-Anti-Malware/3001-8022_4-10852393.html?spi=dc63c449b9cb5c295bfa9891ed910719
    1. HUGO
      une fois ouvert je clique ou?
  14. Destrio5 Modérateur
    Ça ne te demande pas d'enregistrer le fichier d'installation ?

    Au pire, clique sur Download Now dans ce lien :
    http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm
    1. HUGO
      ca yé c installer

      la recherche dinfection est lancée
      deja deux de trouver
      MERCI POUR TON SOUTIENT
  15. Destrio5 Modérateur
    Tu as mis à jour le logiciel avant ?
    1. HUGO
      OUI JE CROIS
    2. HUGO
      Malwarebytes' Anti-Malware 1.19
      Version de la base de données: 904
      Windows 6.0.6000

      00:23:11 30/06/2008
      mbam-log-6-30-2008 (00-23-08).txt

      Type de recherche: Examen rapide
      Eléments examinés: 36316
      Temps écoulé: 3 minute(s), 25 second(s)

      Processus mémoire infecté(s): 1
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 4
      Valeur(s) du Registre infectée(s): 2
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 4
      Fichier(s) infecté(s): 7

      Processus mémoire infecté(s):
      C:\Program Files\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> No action taken.

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.Antivirus2008) -> No action taken.
      HKEY_CURRENT_USER\SOFTWARE\Antivirus2008y (Rogue.Antivirus2008) -> No action taken.
      HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus2008y (Rogue.Antivirus2008) -> No action taken.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/antvrsinstall.exe (Rogue.Installer) -> No action taken.

      Valeur(s) du Registre infectée(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antivirus2008y (Rogue.Antivirus2008) -> No action taken.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\Downloaded Program Files\AntvrsInstall.exe (Rogue.Installer) -> No action taken.

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      C:\Users\Aurélien\AppData\Roaming\Antivirus2008y (Rogue.Antivirus2008) -> No action taken.
      C:\Program Files\Antivirus2008 (Rogue.Antivirus2008) -> No action taken.
      C:\Program Files\Antivirus2008y (Rogue.Antivirus2008) -> No action taken.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y (Rogue.Antivirus2008) -> No action taken.

      Fichier(s) infecté(s):
      C:\Users\Aurélien\Local Settings\Temporary Internet Files\Content.IE5\PUOLMIO8\antvrs.exe (Rogue.Installer) -> No action taken.
      C:\Users\Aurélien\AppData\Roaming\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> No action taken.
      C:\Program Files\Antivirus2008\Antvrs.exe (Rogue.Antivirus2008) -> No action taken.
      C:\Program Files\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> No action taken.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y\Antivirus 2008.lnk (Rogue.Antivirus2008) -> No action taken.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y\Uninstall Antivirus 2008.lnk (Rogue.Antivirus2008) -> No action taken.
      C:\Windows\Downloaded Program Files\AntvrsInstall.exe (Rogue.Installer) -> No action taken.
  16. Destrio5 Modérateur
    Clique sur Supprimer la sélection.
    2. HUGO
      SELECTION SUPPRIMEE
      Malwarebytes' Anti-Malware 1.19
      Version de la base de données: 904
      Windows 6.0.6000

      00:27:31 30/06/2008
      mbam-log-6-30-2008 (00-27-31).txt

      Type de recherche: Examen rapide
      Eléments examinés: 36316
      Temps écoulé: 3 minute(s), 25 second(s)

      Processus mémoire infecté(s): 1
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 4
      Valeur(s) du Registre infectée(s): 2
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 4
      Fichier(s) infecté(s): 7

      Processus mémoire infecté(s):
      C:\Program Files\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> Unloaded process successfully.

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/antvrsinstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\Downloaded Program Files\AntvrsInstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      C:\Users\Aurélien\AppData\Roaming\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      C:\Users\Aurélien\Local Settings\Temporary Internet Files\Content.IE5\PUOLMIO8\antvrs.exe (Rogue.Installer) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008\Antvrs.exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y\Antivirus 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y\Uninstall Antivirus 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Windows\Downloaded Program Files\AntvrsInstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.
  17. Destrio5 Modérateur
    Dans le logiciel.
    1. HUGO
      SELECTION SUPRIMMalwarebytes' Anti-Malware 1.19
      Version de la base de données: 904
      Windows 6.0.6000

      00:27:31 30/06/2008
      mbam-log-6-30-2008 (00-27-31).txt

      Type de recherche: Examen rapide
      Eléments examinés: 36316
      Temps écoulé: 3 minute(s), 25 second(s)

      Processus mémoire infecté(s): 1
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 4
      Valeur(s) du Registre infectée(s): 2
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 4
      Fichier(s) infecté(s): 7

      Processus mémoire infecté(s):
      C:\Program Files\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> Unloaded process successfully.

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/antvrsinstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\Downloaded Program Files\AntvrsInstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      C:\Users\Aurélien\AppData\Roaming\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      C:\Users\Aurélien\Local Settings\Temporary Internet Files\Content.IE5\PUOLMIO8\antvrs.exe (Rogue.Installer) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008\Antvrs.exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Program Files\Antivirus2008y\antvrs.exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y\Antivirus 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Users\Aurélien\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus2008y\Uninstall Antivirus 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Windows\Downloaded Program Files\AntvrsInstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.
      EE
  18. Destrio5 Modérateur
    Redémarre et poste un nouveau rapport HijackThis et dis-moi si tu as encore des problèmes.
    1. HUGO
      REDEMARE LE PC?
  19. Destrio5 Modérateur
    Oui ;)
    1. HUGO
      OK A TOUT DE SUITE
    2. HUGO
      voici le rapport apres redemarage
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 00:38:46, on 30/06/2008
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16609)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\csrss.exe
      C:\Windows\system32\csrss.exe
      C:\Windows\system32\wininit.exe
      C:\Windows\system32\services.exe
      C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsm.exe
      C:\Windows\system32\winlogon.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\system32\Ati2evxx.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\SLsvc.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Windows\System32\spoolsv.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\Ati2evxx.exe
      C:\Windows\system32\Dwm.exe
      C:\Windows\system32\taskeng.exe
      C:\Windows\Explorer.EXE
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
      c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
      C:\Program Files\Alwil Software\Avast4\ashDisp.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\SPYWAREfighter\spftray.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Windows\ehome\ehtray.exe
      C:\Windows\System32\p2phost.exe
      C:\Users\Aurélien\AppData\Roaming\Anuman Interactive\AnumanLive\AnumanLive.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      C:\Windows\ehome\ehmsas.exe
      C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
      C:\Windows\system32\svchost.exe
      C:\Program Files\CyberLink\Shared Files\RichVideo.exe
      C:\Windows\system32\svchost.exe
      C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\system32\SearchIndexer.exe
      C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      C:\Windows\system32\taskeng.exe
      C:\Program Files\SPYWAREfighter\spfprc.exe
      C:\Windows\system32\wbem\wmiprvse.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [freebsd.exe] C:\Users\Aurélien\AppData\Local\Temp\freebsd.exe
      O4 - HKLM\..\Run: [C:\Windows\system32\kdwhb.exe] C:\Windows\system32\kdwhb.exe
      O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
      O4 - HKLM\..\Run: [C:\Windows\system32\kdacq.exe] C:\Windows\system32\kdacq.exe
      O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080612
      O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
      O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
      O4 - HKCU\..\Run: [AnumanLive] C:\Users\Aurélien\AppData\Roaming\Anuman Interactive\AnumanLive\AnumanLive.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
      O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
      O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
    3. HUGO
      N ON PLUS DE PROBLEMMES MERCI MERCI MERCI BOCOUP DESTRIO5 COMMENT PUISJE TE REMERCIER??
    4. HUGO
      TOUJOURS LA?
  20. Destrio5 Modérateur
    Tu as des traces d'infection. Je te prépare quelque chose.
    1. HUGO
      CE NEST PAS FINI ENCORE?
  • 1
  • 2

Discussions similaires

FOTOSE (allemagne)
lix

13 réponses
ATTENTION : escroquerie à la carte bleue !!
dvrg

80 réponses
developement fotos!!
dédé

2 réponses