Viruuuus !

Question

Bonjour,
Alors moi aussi j'ai recu ce fameux vurus par MNS
Nom du fichier : G:\autorun.inf
Nom du fichier malveillant : VBS:Malware-gen
Type de logiciel malveillant : Virus/Ver
Version VPS : 091226-1, 26/12/2009

Silvouplaii keske jdoii faiire exactement pour le supprimé !
Mercii dvotre aide =D

Utilisateur anonyme · Accepted Answer

>Télécharge random's system information tool (RSIT) et sauvegarde-le sur le Bureau. 

• Double-clique sur RSIT.exe afin de lancer RSIT. 

• Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions). 

• RSIT téléchargera Hijackthis (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

• Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

• Poste le contenu de log.txt. 

• Tuto : https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm

Utilisateur anonyme · Answer

&#9654 Télécharge Ad-remover ( de C_XX ) sur ton bureau : 


&#9654 Déconnecte toi et ferme toutes applications en cours ! 

&#9654 Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

&#9654 Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis l'option "L" et tape sur [entrée] .

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log ) 
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

&#9654 Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Tchoup'S · Answer

Mercii beaucoup je fais sa tout de suite et je colle le rappor !

Tchoup'S · Answer

.MERCI VRAIMENT ! VOICI LE RESULTAT
======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 26.12.2009 à 20:47
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à:  2:02:29, 27/12/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 1 v5.1.2600
Nom du PC: NOM-OGL2XDJJQAE | Utilisateur actuel: Propri‚taire

Bonnes fêtes de fin d'année à vous tous :)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
Service: WinSvc  

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\liveplayer_exe.dat 
C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\liveplayer_skin.dat 
C:\WINDOWS\pack.epk 
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Kiwee Toolbar2 
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Live-Player 
C:\Program Files\AskTBar 
C:\Program Files\EoRezo 
C:\Program Files\Kiwee Toolbar2 
C:\Program Files\Live-Player 
C:\Program Files\Viewpoint 
C:\Program Files\Winsudate 
C:\DOCUME~1\PROPRI~1\APPLIC~1\EoRezo 
C:\DOCUME~1\PROPRI~1\APPLIC~1\ItsLabel 
C:\DOCUME~1\PROPRI~1\APPLIC~1\live-player 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar2 
C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\EoRezo 
C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\Kiwee Toolbar2 
C:\DOCUME~1\PROPRI~1\Bureau\Live-Player.lnk 
C:\DOCUME~1\ALLUSE~1\Bureau\Continue Europa Casino setup.lnk 
C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\msafmkre.dat 
C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\msafmkre.exe 
C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\msafmkre_nav.dat 
C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\msafmkre_navps.dat 

(!) -- Fichiers temporaires supprimés.
 
.
HKCU\software\EoRezo
HKCU\software\fcn
HKCU\software\Live-Player
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\msafmkre 
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUsr 
HKLM\Software\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
HKLM\software\classes\appid\EoRezoBHO.DLL
HKLM\Software\Classes\CLSID\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8}
HKLM\Software\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKLM\software\classes\EoRezoBHO.EoBHO
HKLM\software\classes\EoRezoBHO.EoBHO.1
HKLM\Software\Classes\Interface\{819DB72D-1C28-4387-9778-E2FF3DC86F74}
HKLM\Software\Classes\Interface\{DF76E9B7-35EC-46FC-AF56-5B79DED9D64F}
HKLM\Software\Classes\TypeLib\{18AF7201-4F14-4BCF-93FE-45617CF259FF}
HKLM\Software\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
HKLM\software\EoRezo
HKLM\software\Live-Player
HKLM\software\microsoft\shared tools\msconfig\startupreg\EoEngine
HKLM\software\microsoft\shared tools\msconfig\startupreg\SoftwareHelper
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SoftwareHelper 
HKLM\SYSTEM\ControlSet003\Services\winsvc
HKU\.default\software\EoRezo
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.6 [fr] *
.
 Nom du profil: 708vdllo.default (Propri‚taire)
.
(PROPRI~1, Invalidprefs.js) Browser.search.defaultenginename, Chercher Malin
(PROPRI~1, Invalidprefs.js) Browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
(PROPRI~1, Invalidprefs.js) Browser.search.selectedEngine, Chercher Malin
(PROPRI~1, Invalidprefs.js) Browser.startup.homepage, hxxp://www.cherchermalin.com/?t=Q0908143499&s=h
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
. 
(PROPRI~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\PropriÃ©taire\Mes documents\TÃ©lÃ©chargements
(PROPRI~1, prefs.js) Browser.search.defaultenginename, Chercher Malin
(PROPRI~1, prefs.js) Browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
(PROPRI~1, prefs.js) Browser.search.selectedEngine, Google
(PROPRI~1, prefs.js) Browser.startup.homepage, hxxp://www.searcheo.fr/pratique
(PROPRI~1, prefs.js) Extensions.enabledItems, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1,ar@dictionaries.addons.mozilla.org:2.0.20080110,fr@dictionaries.addons.mozilla.org:2.1,{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}:3.5.9,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,jqs@sun.com:1.0,{d9284e50-81fc-11da-a72b-0800200c9a66}:6.2.1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(PROPRI~1, prefs.js) Keyword.URL, hxxp://www.searcheo.fr/pratique?search&q=
. 
.
* Internet Explorer Version 6.0.2800.1106 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\WINDOWS\System32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Use Custom Search URL: 1 (0x1)
Use Search Asst: no
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search Bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
6356 Octet(s) - C:\Ad-Report-CLEAN[1].log 
.
0 Fichier(s) - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp 
3 Fichier(s) - C:\WINDOWS\Temp 
7 Fichier(s) - C:\WINDOWS\Prefetch 
.
18 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
264 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à:  2:13:03 | 27/12/2009 - CLEAN[1]
.
============== E.O.F ==============
.

Utilisateur anonyme · Answer

Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.



&#9654 Télécharge :

Malwarebytes  

ou  :

Malwarebytes

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

&#9654 Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

Tchoup'S · Answer

Mercii je fais sa maintenent et je poste le rapport =D

Tchoup'S · Answer

J'aii un petit soucis 
Quand je met RAPPORT COMPLET on me demande de selectionné le lecteur a examiné !
il y a le lecteur A :/ C:/ D:/ E:/ F:/ G:/ Maiis il y a ke le lecteur C:/ et D:/ qui sont coché !
QUE DOIT JE FAIRE

Utilisateur anonyme · Answer

Tu laisse

Tchoup'S · Answer

Le rapport est terminé MAIS L'ORDINATEUR A REDERMARRé Ou est il enregistré ?

Utilisateur anonyme · Answer

Ouvre Malwarebyte's / Onglet Log, rapports / Copie sont intégralité et envoie le dans ta prochaine réponse.

Tchoup'S · Answer

MERCI VOILAA LE RAPPORT ::
Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3441
Windows 5.1.2600 Service Pack 1
Internet Explorer 6.0.2800.1106

28/12/2009 01:17:33
mbam-log-2009-12-28 (01-17-33).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 226358
Temps écoulé: 1 hour(s), 12 minute(s), 35 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 80

Processus mémoire infecté(s):
C:\WINDOWS\rndll.exe (BackdoorBot) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firevall administrating (BackdoorBot) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://www.postarticles.net) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\Propriétaire\Application Data\DriveCleaner Free (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\DriveCleaner Free (Rogue.DriveCleaner) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\07WCKS25\gibupt[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\07WCKS25\gibusr[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\O7Z9STUM\gibsvc[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Z9MOSO1A\gibcom[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Z9MOSO1A\gibidl[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\DOCUME~1\PROPRI~1\APPLIC~1\EoRezo\SOFTWA~1\SOFTWA\SoftwareUpdate.exe.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\DOCUME~1\PROPRI~1\APPLIC~1\EoRezo\SOFTWA~1\SOFTWA\SoftwareUpdateHP.exe.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\EoRezo\EOA99\EoRezoBHO.dll.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\EoRezo\EoAdv\EoAdv\EoAdv.dll.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\EoRezo\EoEng\EoEngine.exe.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\EoRezo\eorez\eorezo.exe.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\WINSUD~1\gibcom\gibcom.dll.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\WINSUD~1\gibidl\gibidl.dll.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\WINSUD~1\gibsvc\gibsvc.exe.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\WINSUD~1\gibupt\gibupt.exe.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\WINSUD~1\gibusr\gibusr.exe.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0042974.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0042976.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0042977.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0042978.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043001.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043031.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043032.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043033.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043034.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043035.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043037.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AA3F8F0A-60AD-4079-B11F-59E3B100AF75}\RP241\A0043038.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\WINDOWS\image02.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image020.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image023.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image026.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image035.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image044.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image05.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image083.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image086.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\image092.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images18.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images21.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images24.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images33.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images66.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images72.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images81.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images90.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\images96.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo0.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo18.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo21.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo27.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo30.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo39.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo63.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo72.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo78.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo84.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_13.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_16.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_22.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_34.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_64.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_76.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_85.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_88.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photos2007_94.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album1.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album25.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album37.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album43.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album49.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album58.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album7.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album73.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album79.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album82.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album88.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\photo_album91.zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\rndll.exe (BackdoorBot) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Vide la qurantaine de Malwarebyte's :

> Lance Malwarebyte's 
> Onglet quarantaine
> Supprimer tout 


Et refait moi un rapport RSIT stp =)
https://forums.commentcamarche.net/forum/affich-15848347-viruuuus#1

Tchoup'S · Answer

Daccor je fais sa maintenent =D

Tchoup'S · Answer

eske je doi tou fermé comme le premier rappor ?!

Utilisateur anonyme · Answer

Repasse Ad-Remover en option L et envoie le rapport.

Tchoup'S · Answer

MERCI ET VOICI LE RAPPORT ::
======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 26.12.2009 à 20:47
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à:  1:24:58, 30/12/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 1 v5.1.2600
Nom du PC: NOM-OGL2XDJJQAE | Utilisateur actuel: Propri‚taire

Bonnes fêtes de fin d'année à vous tous :)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.


(!) -- Fichiers temporaires supprimés.
 
.
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.6 [fr] *
.
 Nom du profil: 708vdllo.default (Propri‚taire)
.
(PROPRI~1, Invalidprefs.js) Browser.search.defaultenginename, Chercher Malin
(PROPRI~1, Invalidprefs.js) Browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
(PROPRI~1, Invalidprefs.js) Browser.search.selectedEngine, Chercher Malin
(PROPRI~1, Invalidprefs.js) Browser.startup.homepage, hxxp://www.cherchermalin.com/?t=Q0908143499&s=h
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
(PROPRI~1, Invalidprefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
. 
(PROPRI~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\PropriÃ©taire\Mes documents\MES IMAGES\PhOto Neejma\LOGO'S
(PROPRI~1, prefs.js) Browser.search.defaultenginename, Chercher Malin
(PROPRI~1, prefs.js) Browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
(PROPRI~1, prefs.js) Browser.search.selectedEngine, Google
(PROPRI~1, prefs.js) Browser.startup.homepage, hxxp://www.searcheo.fr/pratique
(PROPRI~1, prefs.js) Extensions.enabledItems, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1,ar@dictionaries.addons.mozilla.org:2.0.20080110,fr@dictionaries.addons.mozilla.org:2.1,{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}:3.5.9,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,jqs@sun.com:1.0,{d9284e50-81fc-11da-a72b-0800200c9a66}:6.2.1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(PROPRI~1, prefs.js) Keyword.URL, hxxp://www.searcheo.fr/pratique?search&q=
. 
.
* Internet Explorer Version 6.0.2800.1106 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\WINDOWS\System32\blank.htm
Show_ToolBar: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Use Custom Search URL: 1 (0x1)
Use Search Asst: no
Start Page: hxxp://fr.msn.com/
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search Bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
6725 Octet(s) - C:\Ad-Report-CLEAN[1].log 
3800 Octet(s) - C:\Ad-Report-CLEAN[2].log 
.
0 Fichier(s) - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp 
3 Fichier(s) - C:\WINDOWS\Temp 
6 Fichier(s) - C:\WINDOWS\Prefetch 
.
35 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
253 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à:  1:30:30 | 30/12/2009 - CLEAN[2]
.
============== E.O.F ==============
.

Utilisateur anonyme · Answer

Supprime manuellement ceci : C:\Program Files\EoRezo\eorezo.exe

Et refait moi un RSIT.

Tchoup'S · Answer

Je le supprime où ?? Où est enregistré le fichier ?

Utilisateur anonyme · Answer

Regarde dans Ajout/suppression de programme.


Si non C:\programmes files ...

TchOup'S · Answer

je veux bien mais où ce trouve le " Ajout et Suppression de programme " ???? =)

Viruuuus !

22 réponses

Newsletters