Win32:Rootkit-gen détecté par Avast
Résolu
Bonjour,
Alors voila mon problème Avast détecte Win32:Rootkit-gen toutes les "2 secondes" sur mon fixe et mon portable.
J'ai lu plein de choses differentes sur les forums et comme je ne suis pas une specialiste je ne permet de reposer la question ... est ce que quelqu'un pourrait m'aider ????
Merci d'avance
Alors voila mon problème Avast détecte Win32:Rootkit-gen toutes les "2 secondes" sur mon fixe et mon portable.
J'ai lu plein de choses differentes sur les forums et comme je ne suis pas une specialiste je ne permet de reposer la question ... est ce que quelqu'un pourrait m'aider ????
Merci d'avance
Configuration: Windows XP / Internet Explorer 7.0
57 réponses
Résumé de la discussion
Le problème central est qu'Avast détecte Win32:Rootkit-gen toutes les deux secondes sur des PC sous Windows XP et Internet Explorer 7, ce qui pousse à rechercher des outils et méthodes de nettoyage. Des solutions incluent SEAF pour analyser les fichiers suspects et USBFix pour nettoyer les résidus, complétées par AD-Remover et JavaRa et des mises à jour critiques (XP SP3, Acrobat, Java). Les rapports indiquent des éléments détectés par SEAF (pdagvsa et autres fichiers système) et des entrées de démarrage identifiées par HijackThis, avec une stratégie alliant nettoyage, désinfection et redémarrage avant une vérification. En cas de persistance, il est utile d'exécuter un second avis de sécurité avec un autre antivirus et de vérifier les résultats après le nettoyage.
-
ok je te remercie beaucoup !!!!
j'ai lancé le scan et il n'a trouvé aucune menace !!!!
encore merci !!! je vais faire attention à ce que je fais maintenent !!!
Bon week end !!! -
Contributeur sécuritéPeux-tu envoyer le fichier .zip au concepteur de USBFix ?
Il se trouve en C:\UsbFix_Upload_Me_MARIE-WSQ1PRCYJ.zip
C'est bon, la carte doit être nettoyé.
C'est impressionnant avec ces infections par support. Elles infectent tout type de support.
Si tu le veux, tu peux brancher ta carte et lancer un scan avec Avast.
Tu me diras le résultat.
A+ -
voila c'est fait ... ci joint le rapport :
############################## | UsbFix V6.099 |
User : Marie (Administrateurs) # MARIE-WSQ1PRCYJ
Update on 09/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 18:08:31 | 11/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 2.80GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886542 [ Enabled | Updated ]
A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 29,29 Go (7,98 Go free) # NTFS
D:\ -> Disque fixe local # 47,03 Go (35,51 Go free) # NTFS
E:\ -> Disque CD-ROM # 546,66 Mo (0 Mo free) [Dell 926] # CDFS
F:\ -> Disque amovible # 1,89 Go (1,89 Go free) # FAT
################## | Elements infectieux |
Supprimé ! C:\Recycler\S-1-5-21-842925246-343818398-725345543-1003
Supprimé ! D:\Recycler\S-1-5-21-842925246-343818398-725345543-1003
(!) Non supprimé ! E:\autorun.inf
F:\autorun.inf -> fichier appelé : "F:\wfx062.exe" ( Présent ! )
Supprimé ! F:\wfx062.exe
Supprimé ! F:\autorun.inf
Supprimé ! F:\rg9g9bgq.exe
Supprimé ! F:\ycvvj.exe
################## | Registre |
################## | Mountpoints2 |
################## | Listing des fichiers présent |
[09/09/2007 14:36|--a------|0] C:\AUTOEXEC.BAT
[10/09/2007 19:10|-rahs----|212] C:\boot.ini
[24/04/2003 13:00|-rahs----|4952] C:\Bootfont.bin
[09/09/2007 14:36|--a------|0] C:\CONFIG.SYS
[09/09/2007 14:36|-rahs----|0] C:\IO.SYS
[09/09/2007 14:36|-rahs----|0] C:\MSDOS.SYS
[10/09/2007 19:05|-rahs----|47564] C:\NTDETECT.COM
[20/02/2010 15:58|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[11/03/2010 18:14|--a------|1763] C:\UsbFix.txt
[14/06/2005 20:01|--a------|610304] D:\mastermind.exe
[14/07/2006 16:41|-r-h-----|25] E:\autorun.inf
[03/11/2006 23:07|-r-------|304008] E:\Setup.exe
[02/11/2006 13:44|-r-h-----|162] E:\Setup.ini
[04/08/2008 13:48|---hs----|4096] F:\tfs4_160.ess
################## | Vaccination |
# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# F:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
################## | Upload |
Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_MARIE-WSQ1PRCYJ.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
################## | ! Fin du rapport # UsbFix V6.099 ! | -
Contributeur sécuritéPasse USBFix avec l'option 2.
A+ -
ok merci,
voila le rapport :
############################## | UsbFix V6.099 |
User : Marie (Administrateurs) # MARIE-WSQ1PRCYJ
Update on 09/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 20:49:06 | 10/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 2.80GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886498 [ Enabled | Updated ]
A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 29,29 Go (8,04 Go free) # NTFS
D:\ -> Disque fixe local # 47,03 Go (35,51 Go free) # NTFS
E:\ -> Disque CD-ROM # 546,66 Mo (0 Mo free) [Dell 926] # CDFS
F:\ -> Disque amovible # 1,89 Go (1,89 Go free) # FAT
################## | Elements infectieux |
E:\autorun.inf
F:\autorun.inf -> fichier appelé : "F:\wfx062.exe" ( Présent ! )
F:\autorun.inf
F:\rg9g9bgq.exe
F:\wfx062.exe
F:\ycvvj.exe
################## | Registre |
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{92ed9043-5ee0-11dc-bd44-806d6172696f}
Shell\AutoRun\command =E:\Setup.EXE
HKCU\..\..\Explorer\MountPoints2\{dd8bee0b-2c7c-11df-bea3-000c763fd70e}
Shell\AutoRun\command =F:\wfx062.exe
Shell\open\Command =F:\wfx062.exe
################## | Vaccin |
# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
################## | ! Fin du rapport # UsbFix V6.099 ! | -
Contributeur sécuritéOlgaD,
Utilise USBFix. Il nettoiera l'infection sur ta carte.
( option 1 --> poste le rapport. Je le regarderais )
https://forums.commentcamarche.net/forum/affich-16668206-win32-rootkit-gen-detecte-par-avast#3
A+ -
Bonjour Verni29,
Si tu passes dans le coin j'ai encore une question pour toi :
La carte memoire mini Sd de mon téléphone portable est aussi infecté par le virus. Je l'ai connecté sur mon pc, Avast à detecter le virus mais je n'ai pas reussi à ouvrir le dossier de la carte. Est ce que j'ai reinfecté mon pc ? (avast n'a rien detecté depuis) et comment puis je nettoyer ma carte miniSD ?
Merci d'avance
à+ -
Contributeur sécuritéC'est nickel.
Désinstalle Hijackthis via le panneau de configuration.
Supprime RSIT et SEAF sur ton bureau et le dossier C:\RSIT.
On a terminé.
les deux PC doivent être propre.
Bonne continuation.
Ce fut un échange intéressant.
Salut. -
Contributeur sécuritéOlgaD,
Je t'ai demandé de repasser RSIT car j'avais remarqué un fichier présent dans le 1er rapport que tu avais posté.
C:\DOCUME~1\Marie\LOCALS~1\Temp\Google Toolbar\gtb3A2.tmp.exe
Il n'est pas présent dans le rapport que tu viens de poster mais on va tout de même faire une recherche sur ce fichier.
Si on ne le trouve pas, on aura terminé.
Télécharge SEAF ( de C_XX )
http://pagesperso-orange.fr/NosTools/C_XX/SEAF.exe
# Double clique sur SEAF.exe ("éxécuter en tant qu'administrateur" pour vista) .
# Tape gtb3A2 dans la fenêtre qui s'ouvrira et appuie ensuite sur " Entrée ".
# Laisse l'outil scanner.
# Copie/Colle le rapport qui s'ouvrira dans ton prochain message
A+
-
1. ========================= SEAF 1.0.0.7 - C_XX
2.
3. Commencé à: 14:50:51 le 26/02/2010
4.
5. Valeur(s) recherchée(s):
6.
7. gtb3A2
8.
9.
10. ====== Fichier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
11.
12. Aucun fichier trouvé
13.
14. ====== Dossier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
15.
16. Aucun dossier trouvé
17.
18. =========================
19.
20. Fin à: 14:51:44 le 26/02/2010 ( E.O.F )
-
-
et le rapport log pour le premier pc :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Marie at 2010-02-26 13:28:07
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 9 GB (29%) free of 30 GB
Total RAM: 1023 MB (59% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:28:08, on 26/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Promise Technology, Inc\Promise Array Management\MsgAgt.exe
C:\Program Files\Promise Technology, Inc\Promise Array Management\MsgSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Marie\Bureau\RSIT.exe
C:\Program Files\trend micro\Marie.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0DAA0F3B-5EAA-411B-B4EB-E029C01120CB}: NameServer = 84.103.237.144,86.84.145.144
O17 - HKLM\System\CS2\Services\Tcpip\..\{0DAA0F3B-5EAA-411B-B4EB-E029C01120CB}: NameServer = 84.103.237.144,86.84.145.144
O17 - HKLM\System\CS3\Services\Tcpip\..\{0DAA0F3B-5EAA-411B-B4EB-E029C01120CB}: NameServer = 84.103.237.144,86.84.145.144
O17 - HKLM\System\CS4\Services\Tcpip\..\{0DAA0F3B-5EAA-411B-B4EB-E029C01120CB}: NameServer = 84.103.237.144,86.84.145.144
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Promise Array Message Agent (RAIDmAgt) - Unknown owner - C:\Program Files\Promise Technology, Inc.\Promise Array Management\MsgAgt.exe
O23 - Service: Promise Array Message Server (RAIDmSvr) - Unknown owner - C:\Program Files\Promise Technology, Inc.\Promise Array Management\MsgSvr.exe
-
Bonjour,
voici le rapport Tcleaner :
[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]
--> Recherche:
C:\cleannavi.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\_OTM: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Ad-remover: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !
C:\WINDOWS\system32\*.msnfix: trouvé !
C:\Documents and Settings\Marie Schmitt\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\OTM.exe: trouvé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\Navilog1.exe: trouvé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\Ad-R.exe: trouvé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\UsbFix.exe: trouvé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\Rsit.exe: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
---------------------------------
--> Suppression:
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\OTM.exe: supprimé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\Navilog1.exe: supprimé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\Ad-R.exe: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\cleannavi.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\WINDOWS\msnfix.txt: supprimé !
C:\WINDOWS\system32\*.msnfix: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\UsbFix.exe: supprimé !
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\Rsit.exe: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\_OTM: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Ad-remover: supprimé !
C:\Documents and Settings\Marie Schmitt\Bureau\SmitFraudfix: supprimé !
C:\Program Files\Navilog1: supprimé ! -
bye
-
Contributeur sécuritéBonsoir, clemtheboss413
Oui un max --> ++
@+ -
salut
si sa c'est propagé par internet ca craint max ! ! ! -
Contributeur sécuritéRe,
1/ Lance Hijackthis ( dans C:\ProgramFiles\Trend micro\Hijackthis.exe )et tu choisis " Do a system scan only ".
Tu sélectionnes les lignes suivantes :
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll (file missing)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
Tu choisis l'option " Fixchecked" en bas de la page.
2/ On va enlever les logiciels qui ont été utilisés..
Télécharge ToolsCleaner .sur le bureau
http://pc-system.fr/
Double-clique sur ToolsCleaner2.exe --> Recherche --> Suppression.
Il est possible que ton bureau disparaisse.
Fais un copier/coller du rapport qui se trouve dans C:\TCleaner.txt.
3/ Tu vas utiliser CCleaner.
http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner
utilise les fonctions nettoyeur et registre.
4/ Tu vas nettoyer la restauration système et créer un point propre pour une utilisation ultérieure.
Les points de restauration :
- Panneau de configuration --> Système --> Restauration du système
cocher " Désactiver la restauration .... " ( si elle est cochée sinon la décocher -- > valider -- > cocher )
Une fenêtre va s’ouvrir pour t’avertir que les poins de restauration existants seront supprimés.
Accepte.
Décoche ensuite « Désactiver la restauration .... » pour réactiver la restauration système
- Tu vas recréer un point de restauration propre.
Pour recréer un point de restauration :
Démarrer --> Programmes --> Accessoires --> Outils système --> Restauration système
Choisis "Créer un point de restauration". Suis les invites.
--------------------------------------------------------------------------------------
Sur le 1er PC, télécharge RSIT et poste moi le rapport log.txt.
http://images.malwareremoval.com/random/RSIT.exe
A+ -
Logfile of random's system information tool 1.06 (written by random/random)
Run by Marie Schmitt at 2010-02-25 20:21:21
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 24 GB (52%) free of 46 GB
Total RAM: 446 MB (35% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:21:29, on 25/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Fichiers communs\GtFlashSwitch\GtFlashSwitch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\OrangeFrance\Orange Connect\Orange Connect.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Marie Schmitt\Bureau\Nouveau dossier\RSIT.exe
C:\Program Files\trend micro\Marie Schmitt.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Orange Connect.lnk = C:\Program Files\OrangeFrance\Orange Connect\Orange Connect.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - https://webconnect.cegelec.com/dana-cached/setup/JuniperSetupSP1.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: GtFlashSwitch - OptionNV - C:\Program Files\Fichiers communs\GtFlashSwitch\GtFlashSwitch.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
-
Contributeur sécuritére,
Relance RSIT et poste le rapport obtenu.
A+ -
voila le rappôrt javara :
JavaRa 1.15 Removal Log.
Report follows after line.
------------------------------------
The JavaRa removal process was started on Thu Feb 25 19:42:54 2010
Found and removed: C:\Program Files\Java\jre1.5.0_07
Found and removed: C:\Program Files\Java\jre1.5.0_09
Found and removed: Software\JavaSoft\Java2D\1.5.0_07
Found and removed: Software\JavaSoft\Java2D\1.5.0_09
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510007
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510009
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510007
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510009
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510007
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510009
Found and removed: SOFTWARE\Classes\JavaPlugin.150_07
Found and removed: SOFTWARE\Classes\JavaPlugin.150_09
Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_07
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_09
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_07
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_09
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510007
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510009
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510007
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510009
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150070}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150090}
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_07
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_09
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_07\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_09\
------------------------------------
Finished reporting. -
Contributeur sécuritéOlgaD,
Rien de très méchant dans le rapport.
Des fichiers mis en quarantaine.
Les restaurations système sur les deux partitions C: et D: sont touchées.
On le nettoiera à la fin.
Il reste les mises à jour.
Même manip que sur le message suivant ( et IE8 qui peut installé )
https://forums.commentcamarche.net/forum/affich-16668206-win32-rootkit-gen-detecte-par-avast#13
A+ -
Contributeur sécuritéRe,
Cela arrive.
Essaie avec un autre :
tuto : https://forum.pcastuces.com/default.asp
Poste le rapport obtenu.
A+-
et voila :
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16674 (vista_gdr.080415-1732)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=bf80cbe1f7db25428032db429c045d3c
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-02-25 03:19:29
# local_time=2010-02-25 04:19:29 (+0100, Paris, Madrid)
# country="France"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 173468 173468 0 0
# compatibility_mode=768 16777191 100 0 107204354 107204354 0 0
# compatibility_mode=8192 67108863 100 0 3986 3986 0 0
# scanned=51660
# found=65
# cleaned=0
# scan_time=1971
C:\UsbFix_Upload_Me_MARIE.zip Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP203\A0032408.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP203\A0032427.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP204\A0032434.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP204\A0032452.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032464.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032481.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032504.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032528.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032552.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032573.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032594.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032614.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032634.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032655.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032681.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP206\A0032688.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP206\A0032721.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP206\A0032741.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP207\A0032751.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP207\A0032777.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0032786.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0032967.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033100.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033199.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033237.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033329.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP209\A0033336.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP210\A0033366.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP211\A0033514.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP211\A0033638.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP211\A0033703.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\UsbFix\Quarantine\C\autorun.inf.UsbFix Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
C:\UsbFix\Quarantine\D\autorun.inf.UsbFix Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP203\A0032410.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP203\A0032429.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP204\A0032436.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP204\A0032454.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032466.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032483.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032506.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032530.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032554.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032575.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032596.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032616.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032636.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032657.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP205\A0032683.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP206\A0032690.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP206\A0032723.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP206\A0032743.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP207\A0032753.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP207\A0032779.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0032788.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0032969.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033102.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033200.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033238.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP208\A0033331.INF Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP209\A0033337.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP210\A0033367.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP211\A0033516.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP211\A0033640.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
D:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP211\A0033710.inf Win32/PSW.OnLineGames.NNU trojan 00000000000000000000000000000000 I
-
- 1
- 2
- 3
Suivant
