Antivirus XP 2008
Fermé
Mat'
-
7 août 2008 à 14:01
sherred Messages postés 8346 Date d'inscription samedi 26 janvier 2008 Statut Membre Dernière intervention 25 mars 2024 - 8 août 2008 à 06:26
sherred Messages postés 8346 Date d'inscription samedi 26 janvier 2008 Statut Membre Dernière intervention 25 mars 2024 - 8 août 2008 à 06:26
A voir également:
- Antivirus XP 2008
- Telecharger windows xp - Télécharger - Systèmes d'exploitation
- Comodo antivirus - Télécharger - Sécurité
- Panda antivirus - Télécharger - Antivirus & Antimalwares
- Avast antivirus gratuit - Télécharger - Antivirus & Antimalwares
- Cle windows xp - Guide
13 réponses
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
7 août 2008 à 14:07
7 août 2008 à 14:07
Bonjour
télécharge HijackThis ici:
http://telechargement.zebulon.fr/138-hijackthis-1991.html
https://kerio.probb.fr/
Dézippe le dans un dossier prévu à cet effet.
Par exemple C:\hijackthis < Enregistre le bien dans c : !
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/Hijenr.gif
Lance le puis:
clique sur "do a system scan and save logfile" (cf démo)
faire un copier coller du log entier sur le forum
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm
http://www.tutoriaux-excalibur.com/hijackthis.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
télécharge HijackThis ici:
http://telechargement.zebulon.fr/138-hijackthis-1991.html
https://kerio.probb.fr/
Dézippe le dans un dossier prévu à cet effet.
Par exemple C:\hijackthis < Enregistre le bien dans c : !
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/Hijenr.gif
Lance le puis:
clique sur "do a system scan and save logfile" (cf démo)
faire un copier coller du log entier sur le forum
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm
http://www.tutoriaux-excalibur.com/hijackthis.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
sherred
Messages postés
8346
Date d'inscription
samedi 26 janvier 2008
Statut
Membre
Dernière intervention
25 mars 2024
350
7 août 2008 à 14:07
7 août 2008 à 14:07
télechargez ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html
Lancez HijackThis en double cliquant sur son icône puis cliquez sur le bouton Do a system scan only
Le rapport est retranscrit aussitôt apres le scan dans une fenêtre de type Bloc-notes
il vous suffit de realiser un copier/coller et de le poster dans le forum
Lancez HijackThis en double cliquant sur son icône puis cliquez sur le bouton Do a system scan only
Le rapport est retranscrit aussitôt apres le scan dans une fenêtre de type Bloc-notes
il vous suffit de realiser un copier/coller et de le poster dans le forum
sherred
Messages postés
8346
Date d'inscription
samedi 26 janvier 2008
Statut
Membre
Dernière intervention
25 mars 2024
350
7 août 2008 à 14:09
7 août 2008 à 14:09
oops toptitbal prend le desolé
Merci à vous deux ^^
Bref, voici le log HiJackThis :
-----------------------------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:09:28, on 07/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
C:\Program Files\ThinkVantage\AMSG\Amsg.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\visires\VcxImpAgent.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\IBM ThinkVantage\Client Security Solution\pwmgr.exe
C:\Program Files\IBM ThinkVantage\Common\Logger\logmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\OrangeBs\TaskBarIcon.exe
C:\Program Files\OrangeBs\BusinessEverywhere.exe
C:\Program Files\OrangeBs\ComComp.exe
C:\Program Files\OrangeBs\Watch.exe
C:\WINDOWS\System32\FTCOMM~1\FTCOMM~1.EXE
C:\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.lenovo.com/fr/fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {c5af49a2-94f3-42bd-f434-3604812c897d} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [AMSG] C:\Program Files\ThinkVantage\AMSG\Amsg.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [vfsplash] c:\Program Files\vodafone\vfsplash\vfsplash.exe
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [VcxImpAgent] c:\visires\VcxImpAgent.exe
O4 - HKLM\..\Run: [OBSWATCH] C:\PROGRA~1\OrangeBs\Watch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [*h4bdha7] C:\WINDOWS\system32\habxxiz.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [h4bdha7] C:\WINDOWS\system32\habxxiz.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Odometer.lnk = C:\Program Files\Odometer\Odometer.exe
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: sothink swf catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Mise à jour de logiciels ThinkPad - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {e19adc6e-3909-43e4-9a89-b7b676377ee3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {e19adc6e-3909-43e4-9a89-b7b676377ee3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O11 - Options group: [JAVA_IBM] Java (IBM)
O11 - Options group: [java_sun] Java (Sun)
O14 - IERESET.INF: START_PAGE_URL=https://www.lenovo.com/fr/fr
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = RIXHEIM.CIME.FR
O17 - HKLM\Software\..\Telephony: DomainName = RIXHEIM.CIME.FR
O17 - HKLM\System\CCS\Services\Tcpip\..\{550884DC-278E-4380-AA4F-B5DCBF8A015E}: NameServer = 192.168.1.232
O17 - HKLM\System\CCS\Services\Tcpip\..\{E6E68A4A-8282-49AF-84D2-0FE04D04522E}: NameServer = 194.51.3.56 194.51.3.76
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = RIXHEIM.CIME.FR
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de base IPS (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
Bref, voici le log HiJackThis :
-----------------------------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:09:28, on 07/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
C:\Program Files\ThinkVantage\AMSG\Amsg.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\visires\VcxImpAgent.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\IBM ThinkVantage\Client Security Solution\pwmgr.exe
C:\Program Files\IBM ThinkVantage\Common\Logger\logmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\OrangeBs\TaskBarIcon.exe
C:\Program Files\OrangeBs\BusinessEverywhere.exe
C:\Program Files\OrangeBs\ComComp.exe
C:\Program Files\OrangeBs\Watch.exe
C:\WINDOWS\System32\FTCOMM~1\FTCOMM~1.EXE
C:\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.lenovo.com/fr/fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {c5af49a2-94f3-42bd-f434-3604812c897d} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [AMSG] C:\Program Files\ThinkVantage\AMSG\Amsg.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [vfsplash] c:\Program Files\vodafone\vfsplash\vfsplash.exe
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [VcxImpAgent] c:\visires\VcxImpAgent.exe
O4 - HKLM\..\Run: [OBSWATCH] C:\PROGRA~1\OrangeBs\Watch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [*h4bdha7] C:\WINDOWS\system32\habxxiz.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [h4bdha7] C:\WINDOWS\system32\habxxiz.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Odometer.lnk = C:\Program Files\Odometer\Odometer.exe
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: sothink swf catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Mise à jour de logiciels ThinkPad - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {e19adc6e-3909-43e4-9a89-b7b676377ee3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {e19adc6e-3909-43e4-9a89-b7b676377ee3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O11 - Options group: [JAVA_IBM] Java (IBM)
O11 - Options group: [java_sun] Java (Sun)
O14 - IERESET.INF: START_PAGE_URL=https://www.lenovo.com/fr/fr
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = RIXHEIM.CIME.FR
O17 - HKLM\Software\..\Telephony: DomainName = RIXHEIM.CIME.FR
O17 - HKLM\System\CCS\Services\Tcpip\..\{550884DC-278E-4380-AA4F-B5DCBF8A015E}: NameServer = 192.168.1.232
O17 - HKLM\System\CCS\Services\Tcpip\..\{E6E68A4A-8282-49AF-84D2-0FE04D04522E}: NameServer = 194.51.3.56 194.51.3.76
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = RIXHEIM.CIME.FR
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de base IPS (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
sherred
Messages postés
8346
Date d'inscription
samedi 26 janvier 2008
Statut
Membre
Dernière intervention
25 mars 2024
350
7 août 2008 à 14:23
7 août 2008 à 14:23
habxxiz.exe c'est pas un virus ca ?
J'en ai bien l'impression...
Le scan VirusTotal du fichier en question :
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.29.1 2008.08.01 -
AntiVir 7.8.1.15 2008.08.01 TR/ATRAPS.Gen
Authentium 5.1.0.4 2008.07.31 -
Avast 4.8.1195.0 2008.08.01 -
AVG 8.0.0.156 2008.08.01 BackDoor.Generic9.AZWI
BitDefender 7.2 2008.08.01 -
CAT-QuickHeal 9.50 2008.08.01 (Suspicious) - DNAScan
ClamAV 0.93.1 2008.08.01 Trojan.Banload
DrWeb 4.44.0.09170 2008.08.01 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.6001 2008.08.01 -
Ewido 4.0 2008.08.01 -
F-Prot 4.4.4.56 2008.08.01 -
F-Secure 7.60.13501.0 2008.08.01 -
Fortinet 3.14.0.0 2008.08.01 -
GData 2.0.7306.1023 2008.08.01 -
Ikarus T3.1.1.34.0 2008.08.01 Backdoor.Win32.HacDef.gy
K7AntiVirus 7.10.402 2008.08.01 -
Kaspersky 7.0.0.125 2008.08.01 -
McAfee 5352 2008.08.01 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3317 2008.08.01 -
Norman 5.80.02 2008.08.01 -
Panda 9.0.0.4 2008.08.01 Suspicious file
PCTools 4.4.2.0 2008.08.01 -
Prevx1 V2 2008.08.01 Suspicious
Rising 20.55.42.00 2008.08.01 -
Sophos 4.31.0 2008.08.01 Sus/UnkPacker
Sunbelt 3.1.1537.1 2008.08.01 -
Symantec 10 2008.08.01 -
TheHacker 6.2.96.391 2008.07.31 -
TrendMicro 8.700.0.1004 2008.08.01 PAK_Generic.001
VBA32 3.12.8.2 2008.08.01 Backdoor.Win32.IRCBot.edk
ViRobot 2008.8.1.1321 2008.08.01 -
VirusBuster 4.5.11.0 2008.08.01 -
Webwasher-Gateway 6.6.2 2008.08.01 Trojan.ATRAPS.Gen
Le scan VirusTotal du fichier en question :
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.29.1 2008.08.01 -
AntiVir 7.8.1.15 2008.08.01 TR/ATRAPS.Gen
Authentium 5.1.0.4 2008.07.31 -
Avast 4.8.1195.0 2008.08.01 -
AVG 8.0.0.156 2008.08.01 BackDoor.Generic9.AZWI
BitDefender 7.2 2008.08.01 -
CAT-QuickHeal 9.50 2008.08.01 (Suspicious) - DNAScan
ClamAV 0.93.1 2008.08.01 Trojan.Banload
DrWeb 4.44.0.09170 2008.08.01 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.6001 2008.08.01 -
Ewido 4.0 2008.08.01 -
F-Prot 4.4.4.56 2008.08.01 -
F-Secure 7.60.13501.0 2008.08.01 -
Fortinet 3.14.0.0 2008.08.01 -
GData 2.0.7306.1023 2008.08.01 -
Ikarus T3.1.1.34.0 2008.08.01 Backdoor.Win32.HacDef.gy
K7AntiVirus 7.10.402 2008.08.01 -
Kaspersky 7.0.0.125 2008.08.01 -
McAfee 5352 2008.08.01 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3317 2008.08.01 -
Norman 5.80.02 2008.08.01 -
Panda 9.0.0.4 2008.08.01 Suspicious file
PCTools 4.4.2.0 2008.08.01 -
Prevx1 V2 2008.08.01 Suspicious
Rising 20.55.42.00 2008.08.01 -
Sophos 4.31.0 2008.08.01 Sus/UnkPacker
Sunbelt 3.1.1537.1 2008.08.01 -
Symantec 10 2008.08.01 -
TheHacker 6.2.96.391 2008.07.31 -
TrendMicro 8.700.0.1004 2008.08.01 PAK_Generic.001
VBA32 3.12.8.2 2008.08.01 Backdoor.Win32.IRCBot.edk
ViRobot 2008.8.1.1321 2008.08.01 -
VirusBuster 4.5.11.0 2008.08.01 -
Webwasher-Gateway 6.6.2 2008.08.01 Trojan.ATRAPS.Gen
sherred
Messages postés
8346
Date d'inscription
samedi 26 janvier 2008
Statut
Membre
Dernière intervention
25 mars 2024
350
7 août 2008 à 16:50
7 août 2008 à 16:50
ok
Télécharge et installe Malwarebyte's Anti-Malware
https://www.commentcamarche.net/telecharger/ 34055379 malwarebyte s anti malware
A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware soit cochée. clique sur OK
Lance Malwarebyte's Anti-Malware en double-cliquant sur l'icône sur ton Bureau.
Au premier lancement, une fenêtre t'annonce que la version est Free clique sur OK
Laisse les Mises à jour se télécharger
Lance Malwarebyte's Anti-Malware
Puis vas dans l'onglet "Recherche" puis coche "Exécuter un examen complet" puis "Rechercher sélectionne tes disques durs" puis clique sur "Lancer l’examen"
A la fin du scan clique sur Afficher les résultats puis sur Enregistrer le rapport
Suppression des éléments détectés clique sur Supprimer la sélection
S'il t'es demandé de redémarrer clique sur "Yes"
pense a installer un BON pare feu
Télécharge et installe Malwarebyte's Anti-Malware
https://www.commentcamarche.net/telecharger/ 34055379 malwarebyte s anti malware
A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware soit cochée. clique sur OK
Lance Malwarebyte's Anti-Malware en double-cliquant sur l'icône sur ton Bureau.
Au premier lancement, une fenêtre t'annonce que la version est Free clique sur OK
Laisse les Mises à jour se télécharger
Lance Malwarebyte's Anti-Malware
Puis vas dans l'onglet "Recherche" puis coche "Exécuter un examen complet" puis "Rechercher sélectionne tes disques durs" puis clique sur "Lancer l’examen"
A la fin du scan clique sur Afficher les résultats puis sur Enregistrer le rapport
Suppression des éléments détectés clique sur Supprimer la sélection
S'il t'es demandé de redémarrer clique sur "Yes"
pense a installer un BON pare feu
Sorry pour l'attente ;)
Voici le log :
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1030
Windows 5.1.2600 Service Pack 2
19:39:16 07/08/2008
mbam-log-8-7-2008 (19-39-12).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 132123
Temps écoulé: 42 minute(s), 34 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP145\A0041073.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043098.exe (Rogue.Agent) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043851.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043853.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043858.exe (Trojan.Dropper) -> No action taken.
C:\WINDOWS\system32\15.tmp (Rogue.Agent) -> No action taken.
C:\WINDOWS\system32\16.tmp (Rogue.Agent) -> No action taken.
C:\WINDOWS\system32\17.tmp (Rogue.Agent) -> No action taken.
Voici le log :
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1030
Windows 5.1.2600 Service Pack 2
19:39:16 07/08/2008
mbam-log-8-7-2008 (19-39-12).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 132123
Temps écoulé: 42 minute(s), 34 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP145\A0041073.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043098.exe (Rogue.Agent) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043851.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043853.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043858.exe (Trojan.Dropper) -> No action taken.
C:\WINDOWS\system32\15.tmp (Rogue.Agent) -> No action taken.
C:\WINDOWS\system32\16.tmp (Rogue.Agent) -> No action taken.
C:\WINDOWS\system32\17.tmp (Rogue.Agent) -> No action taken.
Oups, mauvais log :
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1030
Windows 5.1.2600 Service Pack 2
19:39:24 07/08/2008
mbam-log-8-7-2008 (19-39-24).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 132123
Temps écoulé: 42 minute(s), 34 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP145\A0041073.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043098.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043851.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043853.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043858.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\15.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\16.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\17.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1030
Windows 5.1.2600 Service Pack 2
19:39:24 07/08/2008
mbam-log-8-7-2008 (19-39-24).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 132123
Temps écoulé: 42 minute(s), 34 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP145\A0041073.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043098.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043851.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043853.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043858.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\15.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\16.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\17.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
Re-bonsoir,
Je viens de désinstaller Mc Afee VirusScan contre Antivir que je connais bien. Il m'a effectivement détecté habxxiz.exe comme "TR/ATRAPS.Gen [trojan]".
Je l'ai supprimé sans problème apparent ni reboot nécessaire. Dans l'attente d'un éventuel scan à effectuer pour m'assurer que tout est clean =)
Mat'
Je viens de désinstaller Mc Afee VirusScan contre Antivir que je connais bien. Il m'a effectivement détecté habxxiz.exe comme "TR/ATRAPS.Gen [trojan]".
Je l'ai supprimé sans problème apparent ni reboot nécessaire. Dans l'attente d'un éventuel scan à effectuer pour m'assurer que tout est clean =)
Mat'
Désolé pour le quadruple-post =/, mais je viens de terminer une analyse Antivir et le résultat est méchant, il m'a détecté pas moins de 30 fichiers infectés !
Voici le log, tous supprimés sans problème une fois encore après un passage en quarantaine :
Avira AntiVir Personal
Report file date: vendredi 8 août 2008 02:05
Scanning for 1540477 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: PORTABLEAZ
Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 23:55:33
ANTIVIR2.VDF : 7.0.5.207 2316800 Bytes 04/08/2008 23:56:57
ANTIVIR3.VDF : 7.0.5.229 136192 Bytes 07/08/2008 23:57:03
Engineversion : 8.1.1.19
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.63 311673 Bytes 07/08/2008 23:58:20
AESCN.DLL : 8.1.0.23 119156 Bytes 07/08/2008 23:58:15
AERDL.DLL : 8.1.0.20 418165 Bytes 07/08/2008 23:58:13
AEPACK.DLL : 8.1.2.1 364917 Bytes 07/08/2008 23:58:06
AEOFFICE.DLL : 8.1.0.21 192891 Bytes 07/08/2008 23:57:59
AEHEUR.DLL : 8.1.0.47 1368437 Bytes 07/08/2008 23:57:54
AEHELP.DLL : 8.1.0.15 115063 Bytes 07/08/2008 23:57:33
AEGEN.DLL : 8.1.0.35 315764 Bytes 07/08/2008 23:57:28
AEEMU.DLL : 8.1.0.7 430452 Bytes 07/08/2008 23:57:19
AECORE.DLL : 8.1.1.8 172406 Bytes 07/08/2008 23:57:10
AEBB.DLL : 8.1.0.1 53617 Bytes 07/08/2008 23:57:06
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 8.0.0.2 98344 Bytes 07/08/2008 23:57:04
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: vendredi 8 août 2008 02:05
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'msiexec.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'verclsid.exe' - '0' Module(s) have been scanned
Scan process 'verclsid.exe' - '0' Module(s) have been scanned
Scan process 'shcfg32.exe' - '0' Module(s) have been scanned
Scan process 'shcfg32.exe' - '0' Module(s) have been scanned
Scan process 'mcconsol.exe' - '0' Module(s) have been scanned
Scan process 'mcconsol.exe' - '0' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'notepad++.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'Odometer.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMM~1.EXE' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'BusinessEverywhere.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'SvcGuiHlpr.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'logmon.exe' - '1' Module(s) have been scanned
Scan process 'pwmgr.exe' - '1' Module(s) have been scanned
Scan process 'BTSTAC~1.EXE' - '1' Module(s) have been scanned
Scan process 'DLG.exe' - '1' Module(s) have been scanned
Scan process 'BTTray.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'VcxImpAgent.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'ACWLIcon.exe' - '1' Module(s) have been scanned
Scan process 'ACTray.exe' - '1' Module(s) have been scanned
Scan process 'PicasaMediaDetector.exe' - '1' Module(s) have been scanned
Scan process 'pdservice.exe' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'DLACTRLW.EXE' - '1' Module(s) have been scanned
Scan process 'AMSG.EXE' - '1' Module(s) have been scanned
Scan process 'LPMGR.EXE' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'TpScrex.exe' - '1' Module(s) have been scanned
Scan process 'TPONSCR.exe' - '1' Module(s) have been scanned
Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned
Scan process 'TPHKMGR.exe' - '1' Module(s) have been scanned
Scan process 'EZEJMNAP.EXE' - '1' Module(s) have been scanned
Scan process 'TpShocks.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'cssauth.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'AcSvc.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'UCLauncherService.exe' - '1' Module(s) have been scanned
Scan process 'tvtsched.exe' - '1' Module(s) have been scanned
Scan process 'rrservice.exe' - '1' Module(s) have been scanned
Scan process 'ibmtcsd.exe' - '1' Module(s) have been scanned
Scan process 'TpKmpSvc.exe' - '1' Module(s) have been scanned
Scan process 'TPHDEXLG.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'btwdins.exe' - '1' Module(s) have been scanned
Scan process 'AcPrfMgrSvc.exe' - '1' Module(s) have been scanned
Scan process 'IPSSVC.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned
Scan process 'EvtEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'ibmpmsvc.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
77 processes with 77 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '68' files ).
Starting the file scan:
Begin scan in 'C:\' <IBM_PRELOAD>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043849.exe
[0] Archive type: RAR SFX (self extracting)
--> crack.exe
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[DETECTION] Contains detection pattern of the dropper DR/Virtumonde.adzb
--> serial.exe
[DETECTION] Is the Trojan horse TR/Dldr.7160
--> number.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> keygen.exe
[DETECTION] Is the Trojan horse TR/Obfuscated.ttc
[NOTE] The file was moved to '48cb9739.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043852.exe
[DETECTION] Is the Trojan horse TR/Obfuscated.ttc
[NOTE] The file was moved to '48cb973e.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043855.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9740.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043856.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9741.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043857.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9743.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043859.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9745.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043860.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9747.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043861.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9748.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043862.DLL
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb974a.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043863.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb974c.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043864.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb974e.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043866.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9750.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043868.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9752.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044079.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9753.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044080.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9755.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044081.dll
[DETECTION] Is the Trojan horse TR/Drop.Softomat.AN
[NOTE] The file was moved to '48cb9756.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044097.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9758.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044099.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9759.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044100.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb975b.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP147\A0044125.exe
[0] Archive type: RAR SFX (self extracting)
--> crack.exe
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[DETECTION] Contains detection pattern of the dropper DR/Virtumonde.adzb
--> serial.exe
[DETECTION] Is the Trojan horse TR/Dldr.7160
--> number.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> keygen.exe
[DETECTION] Is the Trojan horse TR/Obfuscated.ttc
[NOTE] The file was moved to '48cb9760.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP148\A0044248.exe
[DETECTION] Is the Trojan horse TR/ATRAPS.Gen
[NOTE] The file was moved to '48cb9767.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP153\A0045678.exe
[DETECTION] Is the Trojan horse TR/ATRAPS.Gen
[NOTE] The file was moved to '48cb9788.qua'!
C:\WINDOWS\xr4tdwa.exe
[0] Archive type: RSRC
--> Object
[DETECTION] Is the Trojan horse TR/Dropper.Gen
[NOTE] The file was moved to '48cf9819.qua'!
C:\WINDOWS\system32\drivers\6073980d.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
End of the scan: vendredi 8 août 2008 02:56
Used time: 51:04 min
The scan has been done completely.
7653 Scanning directories
367804 Files were scanned
31 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
23 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
367773 Files not concerned
8415 Archives were scanned
4 Warnings
23 Notes
Voici le log, tous supprimés sans problème une fois encore après un passage en quarantaine :
Avira AntiVir Personal
Report file date: vendredi 8 août 2008 02:05
Scanning for 1540477 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: PORTABLEAZ
Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 23:55:33
ANTIVIR2.VDF : 7.0.5.207 2316800 Bytes 04/08/2008 23:56:57
ANTIVIR3.VDF : 7.0.5.229 136192 Bytes 07/08/2008 23:57:03
Engineversion : 8.1.1.19
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.63 311673 Bytes 07/08/2008 23:58:20
AESCN.DLL : 8.1.0.23 119156 Bytes 07/08/2008 23:58:15
AERDL.DLL : 8.1.0.20 418165 Bytes 07/08/2008 23:58:13
AEPACK.DLL : 8.1.2.1 364917 Bytes 07/08/2008 23:58:06
AEOFFICE.DLL : 8.1.0.21 192891 Bytes 07/08/2008 23:57:59
AEHEUR.DLL : 8.1.0.47 1368437 Bytes 07/08/2008 23:57:54
AEHELP.DLL : 8.1.0.15 115063 Bytes 07/08/2008 23:57:33
AEGEN.DLL : 8.1.0.35 315764 Bytes 07/08/2008 23:57:28
AEEMU.DLL : 8.1.0.7 430452 Bytes 07/08/2008 23:57:19
AECORE.DLL : 8.1.1.8 172406 Bytes 07/08/2008 23:57:10
AEBB.DLL : 8.1.0.1 53617 Bytes 07/08/2008 23:57:06
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 8.0.0.2 98344 Bytes 07/08/2008 23:57:04
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: vendredi 8 août 2008 02:05
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'msiexec.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'verclsid.exe' - '0' Module(s) have been scanned
Scan process 'verclsid.exe' - '0' Module(s) have been scanned
Scan process 'shcfg32.exe' - '0' Module(s) have been scanned
Scan process 'shcfg32.exe' - '0' Module(s) have been scanned
Scan process 'mcconsol.exe' - '0' Module(s) have been scanned
Scan process 'mcconsol.exe' - '0' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'notepad++.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'Odometer.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMM~1.EXE' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'BusinessEverywhere.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'SvcGuiHlpr.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'logmon.exe' - '1' Module(s) have been scanned
Scan process 'pwmgr.exe' - '1' Module(s) have been scanned
Scan process 'BTSTAC~1.EXE' - '1' Module(s) have been scanned
Scan process 'DLG.exe' - '1' Module(s) have been scanned
Scan process 'BTTray.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'VcxImpAgent.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'ACWLIcon.exe' - '1' Module(s) have been scanned
Scan process 'ACTray.exe' - '1' Module(s) have been scanned
Scan process 'PicasaMediaDetector.exe' - '1' Module(s) have been scanned
Scan process 'pdservice.exe' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'DLACTRLW.EXE' - '1' Module(s) have been scanned
Scan process 'AMSG.EXE' - '1' Module(s) have been scanned
Scan process 'LPMGR.EXE' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'TpScrex.exe' - '1' Module(s) have been scanned
Scan process 'TPONSCR.exe' - '1' Module(s) have been scanned
Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned
Scan process 'TPHKMGR.exe' - '1' Module(s) have been scanned
Scan process 'EZEJMNAP.EXE' - '1' Module(s) have been scanned
Scan process 'TpShocks.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'cssauth.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'AcSvc.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'UCLauncherService.exe' - '1' Module(s) have been scanned
Scan process 'tvtsched.exe' - '1' Module(s) have been scanned
Scan process 'rrservice.exe' - '1' Module(s) have been scanned
Scan process 'ibmtcsd.exe' - '1' Module(s) have been scanned
Scan process 'TpKmpSvc.exe' - '1' Module(s) have been scanned
Scan process 'TPHDEXLG.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'btwdins.exe' - '1' Module(s) have been scanned
Scan process 'AcPrfMgrSvc.exe' - '1' Module(s) have been scanned
Scan process 'IPSSVC.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned
Scan process 'EvtEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'ibmpmsvc.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
77 processes with 77 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '68' files ).
Starting the file scan:
Begin scan in 'C:\' <IBM_PRELOAD>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043849.exe
[0] Archive type: RAR SFX (self extracting)
--> crack.exe
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[DETECTION] Contains detection pattern of the dropper DR/Virtumonde.adzb
--> serial.exe
[DETECTION] Is the Trojan horse TR/Dldr.7160
--> number.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> keygen.exe
[DETECTION] Is the Trojan horse TR/Obfuscated.ttc
[NOTE] The file was moved to '48cb9739.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043852.exe
[DETECTION] Is the Trojan horse TR/Obfuscated.ttc
[NOTE] The file was moved to '48cb973e.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043855.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9740.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043856.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9741.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043857.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9743.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043859.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9745.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043860.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9747.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043861.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9748.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043862.DLL
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb974a.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043863.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb974c.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043864.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb974e.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043866.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9750.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0043868.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9752.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044079.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9753.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044080.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9755.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044081.dll
[DETECTION] Is the Trojan horse TR/Drop.Softomat.AN
[NOTE] The file was moved to '48cb9756.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044097.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9758.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044099.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb9759.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP146\A0044100.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48cb975b.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP147\A0044125.exe
[0] Archive type: RAR SFX (self extracting)
--> crack.exe
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[DETECTION] Contains detection pattern of the dropper DR/Virtumonde.adzb
--> serial.exe
[DETECTION] Is the Trojan horse TR/Dldr.7160
--> number.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> keygen.exe
[DETECTION] Is the Trojan horse TR/Obfuscated.ttc
[NOTE] The file was moved to '48cb9760.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP148\A0044248.exe
[DETECTION] Is the Trojan horse TR/ATRAPS.Gen
[NOTE] The file was moved to '48cb9767.qua'!
C:\System Volume Information\_restore{C99FC601-9195-45D9-99B4-B165C7973F04}\RP153\A0045678.exe
[DETECTION] Is the Trojan horse TR/ATRAPS.Gen
[NOTE] The file was moved to '48cb9788.qua'!
C:\WINDOWS\xr4tdwa.exe
[0] Archive type: RSRC
--> Object
[DETECTION] Is the Trojan horse TR/Dropper.Gen
[NOTE] The file was moved to '48cf9819.qua'!
C:\WINDOWS\system32\drivers\6073980d.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
End of the scan: vendredi 8 août 2008 02:56
Used time: 51:04 min
The scan has been done completely.
7653 Scanning directories
367804 Files were scanned
31 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
23 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
367773 Files not concerned
8415 Archives were scanned
4 Warnings
23 Notes
sherred
Messages postés
8346
Date d'inscription
samedi 26 janvier 2008
Statut
Membre
Dernière intervention
25 mars 2024
350
8 août 2008 à 06:26
8 août 2008 à 06:26
joli boulot
mais c'est pas fini suit bien ce qui suit
1er etape
VundoFix
Télécharge VundoFix sur ton bureau.http://www.atribune.org/ccount/click.php?id=4
Double-clique sur VundoFix.exe afin de le lancer, puis clique sur le bouton "Scan for Vundo".
Lorsque le scan est terminé, clique sur le bouton "Remove Vundo".
Une invite te demandera si tu veux supprimer les fichiers, dit oui
le Bureau devrait disparaîte lors de la suppression des fichiers
tu verra ensuite une invite qui t'annoncera que ton PC va s'éteindre (shutdown en anglais) : clique sur OK.
redémarre-le., pour la 2eme étape
ComboFix
utiliser ComboFix pour nettoyer certains fichiers récalcitrants de Vundo
Télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau.
Redémarre ton PC en mode sans échec.
Double clique sur ComboFix.exe
Tape sur la touche Y pour démarrer le scan.
ComboFix redémarrera ton PC : suivre les instructions indiquées à l'écran.
3eme etape désactive la restauration
Menu Démarrer -> Tous les programmes -> Accessoires -> Outils systeme -> Restauration du systeme->volet de gauche "parametres de la restauration du systeme "et là cocher "désactiver la restauration du systeme"
enfin 4 eme etape refait un scan Hijack et poste le
mais c'est pas fini suit bien ce qui suit
1er etape
VundoFix
Télécharge VundoFix sur ton bureau.http://www.atribune.org/ccount/click.php?id=4
Double-clique sur VundoFix.exe afin de le lancer, puis clique sur le bouton "Scan for Vundo".
Lorsque le scan est terminé, clique sur le bouton "Remove Vundo".
Une invite te demandera si tu veux supprimer les fichiers, dit oui
le Bureau devrait disparaîte lors de la suppression des fichiers
tu verra ensuite une invite qui t'annoncera que ton PC va s'éteindre (shutdown en anglais) : clique sur OK.
redémarre-le., pour la 2eme étape
ComboFix
utiliser ComboFix pour nettoyer certains fichiers récalcitrants de Vundo
Télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau.
Redémarre ton PC en mode sans échec.
Double clique sur ComboFix.exe
Tape sur la touche Y pour démarrer le scan.
ComboFix redémarrera ton PC : suivre les instructions indiquées à l'écran.
3eme etape désactive la restauration
Menu Démarrer -> Tous les programmes -> Accessoires -> Outils systeme -> Restauration du systeme->volet de gauche "parametres de la restauration du systeme "et là cocher "désactiver la restauration du systeme"
enfin 4 eme etape refait un scan Hijack et poste le
