Pop-up pub dans navigateur
Résolu
Bonjour,
j'ai des fenetres publicitaires qui s'ouvrent dans mes navigateurs aussi bien dans ie que dans mozilla
merci de l'aider
j'ai des fenetres publicitaires qui s'ouvrent dans mes navigateurs aussi bien dans ie que dans mozilla
merci de l'aider
Configuration: Windows XP Firefox 2.0.0.13
17 réponses
Résumé de la discussion
Des fenêtres publicitaires s'ouvrent dans les navigateurs sous Windows XP, notamment Firefox, ce qui déclenche une démarche de nettoyage et de sécurisation pour prévenir de nouvelles intrusions. Plusieurs conseils de sécurité et outils ont été partagés, tels que Malewarebytes, CCleaner et une analyse antivirus en ligne pour identifier les infections et nettoyer les traces. D'autres interventions évoquent HijackThis, la suppression de profils Thunderbird, et le ciblage de dossiers Function.zip et fichiers malveillants pour rétablir le fonctionnement normal du système. En cas d'échec, certains proposent une remise à zéro du système ou l'utilisation d'outils spécifiques comme VundoFix pour éradiquer les menaces résiduelles et prévenir une réinfection future.
-
Contributeur sécuritébonjour, heureux d'avoir pu d'aider pour tes toolbars se serait mieux de les supprimer je te files l'adresse du logiciels tu en fais ce que tu veux http://cluster1.easy-hebergement.net/
bon dimanche @+ -
ok tout à l'air de fonctionner normalment
Merci beaucoup - Roland -
Contributeur sécuritébonjour, tu as tout ça à fixer je te mets un tutorirel au cas ou tu ne saurrais pas trop comment les fixer http://pageperso.aol.fr/balltrap34/demohijack.htm
et après tu passes ccleaner dans ses deux modes "perso chez moi sur les 5 pc de la maison il est en automatique comme ça il nettoit à chaque démarrage, pour le registre je le fais soit après chaque désinstallation ou une fois semaine" par contre je t'ai pas mis toute les toolbars si tu veux les supprimer je te filerais un logiciel pour
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.DLL
O3 - Toolbar: (no name) - {039036AA-7710-11D7-ACDA-00B0D094B576} - (no file)
O4 - HKCU\..\Policies\Explorer\Run: [{5400023B-0BBE-1036-1106-031127200021}] "C:\Program Files\Fichiers communs\{5400023B-0BBE-1036-1106-031127200021}\Update.exe" mc-110-12-0000272
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add &Link to NewsPoint - res://C:\Program Files\Consenda\NewsPoint\Bin\NPHelper.dll/#201
O8 - Extra context menu item: Add &Page to NewsPoint - res://C:\Program Files\Consenda\NewsPoint\Bin\NPHelper.dll/#202
O8 - Extra context menu item: Voir les cookies - C:\WINDOWS\web\showcookies.htm
O9 - Extra button: (no name) - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2114 - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra button: Launch NewsPoint - {b8c7FF31-8251-11d4-8a0c-00c04fbcb670} - C:\Program Files\Consenda\NewsPoint\Bin\NewsPoint.exe (file missing)
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/SP.cab -
Merci Jacques,
Je fais et bonne nuit à toi.
A demain pour plus de nouvelles et encore merci
Roland -
Contributeur sécuritébon tu fini navilog avec l'opion 2 comme expliqué et tu passe vundofix
Télécharge VundoFix: http://www.atribune.org/ccount/click.php?id=4
Double-cliquez sur VundoFix.exe afin de le lancer, puis cliquez sur le bouton "Scan for Vundo".
Lorsque le scan est terminé, cliquez sur le bouton "Remove Vundo".
Une invite vous demandera si vous voulez supprimer les fichiers, cliquez sur YES.
Après avoir cliqué sur Yes, le Bureau disparaîtra un moment lors de la suppression des fichiers (ne vous inquiétez pas c'est normal !).
Vous verrez ensuite une invite qui vous annoncera que votre PC va s'éteindre (shutdown en anglais) : cliquez sur OK.
Une fois votre PC éteint, redémarrez-le.
et verifis si navilog retrouve quelque chose sur ce bonne nuit-
Bonjour,
Aujourd'hui tout marche bien, plus de popup, ; merci pour ce temps et ces efforts. j'ai fait un dernier hithisjack, y-a-t-il des lignes à fixer ? Roland
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:42:48, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\umonit.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Megaupload\Mega Manager\MegaManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.pianomajeur.net/forum/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: IeMonitorBho Class - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Ask Toolbar BHO - {F4D76F01-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - Toolbar: (no name) - {039036AA-7710-11D7-ACDA-00B0D094B576} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Policies\Explorer\Run: [{5400023B-0BBE-1036-1106-031127200021}] "C:\Program Files\Fichiers communs\{5400023B-0BBE-1036-1106-031127200021}\Update.exe" mc-110-12-0000272
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add &Link to NewsPoint - res://C:\Program Files\Consenda\NewsPoint\Bin\NPHelper.dll/#201
O8 - Extra context menu item: Add &Page to NewsPoint - res://C:\Program Files\Consenda\NewsPoint\Bin\NPHelper.dll/#202
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: SYSTRAN: &Effacer le cache de traduction - C:\Program Files\Systran\Premium\menuClearCache.html
O8 - Extra context menu item: SYSTRAN: &Options - C:\Program Files\Systran\Premium\menuConfigure.html
O8 - Extra context menu item: SYSTRAN: &Traduire - C:\Program Files\Systran\Premium\menuTranslate.html
O8 - Extra context menu item: SYSTRAN: En®istrement - C:\Program Files\Systran\Premium\menuRegister.html
O8 - Extra context menu item: SYSTRAN: Rechercher les &mises à jour - C:\Program Files\Systran\Premium\menuUpdate.html
O8 - Extra context menu item: SYSTRAN: Traduire les &cadres - C:\Program Files\Systran\Premium\menuTranslateAll.html
O8 - Extra context menu item: Voir les cookies - C:\WINDOWS\web\showcookies.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: @sysiecom.dll,-2100 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslate.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2102 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslate.html
O9 - Extra button: @sysiecom.dll,-2103 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2105 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra button: @sysiecom.dll,-2115 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuConfigure.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2117 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuConfigure.html
O9 - Extra button: (no name) - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuClearCache.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2108 - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuClearCache.html
O9 - Extra button: (no name) - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuRegister.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2111 - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuRegister.html
O9 - Extra button: (no name) - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2114 - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Launch NewsPoint - {b8c7FF31-8251-11d4-8a0c-00c04fbcb670} - C:\Program Files\Consenda\NewsPoint\Bin\NewsPoint.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/SP.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4F353BD-EB2A-48D5-A16D-3CECE127521A}: NameServer = 127.0.0.1,192.168.1.1,0.0.0.0
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
-
Contributeur sécuritéok une fois fais dis si tu as encore de pubs
-
-
Contributeur sécurité@roland26je parlais après le nettoyage avec navilog
-
-
Contributeur sécuritébonjour, c'est ligne ont l'aire d'avoir été supprimé mais tu peux aller dans ton disque dure dans documents and setting dans roland tu supprimes les dossiers function.zip si ils y sont
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll
C:\Documents and Settings\roland\Function.zip=>xynx.hex
puis passe navilog1 http://infotuto.servhome.org/tutoriel/Navilog1.php lis bien le tutoriel jusqu'au bout pour bien appliquer-
-
@roland26Bonsoir,
Voilà le rapport de navilog
earch Navipromo version 3.5.1 commencé le 29/03/2008 à 0:16:23,56
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "roland"
Mise à jour le 23.03.2008 à 22h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS
Executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\WINDOWS ***
*** Recherche dossiers dans C:\Program Files ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***
*** Recherche dossiers dans "C:\Documents and Settings\roland\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\roland\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\roland\menudm~1\progra~1" ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\WINDOWS\system32 *
* Recherche dans "C:\Documents and Settings\roland\locals~1\applic~1" *
* Recherche dans "C:\docume~1\Administrateur\locals~1\applic~1" *
* Recherche dans "C:\docume~1\earl master\locals~1\applic~1" *
*** Recherche fichiers ***
C:\WINDOWS\system32\nvs2.inf trouvé !
*** Recherche clés spécifiques dans le Registre ***
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans C:\WINDOWS\system32 :
comfvy.dat trouvé !
mchmaaouao.dat trouvé !
mchmaaouao_nav.dat trouvé !
mchmaaouao_navps.dat trouvé !
* Dans "C:\Documents and Settings\roland\locals~1\applic~1" :
* Dans "C:\docume~1\Administrateur\locals~1\applic~1" :
* Dans "C:\docume~1\earl master\locals~1\applic~1" :
3)Recherche Certificats :
Certificat Egroup trouvé !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
C:\WINDOWS\system32\ffhkj.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\ffhkj.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\ffhkj.bak2 trouvé ! infection Vundo possible non traitée par cet outil !
*** Analyse terminée le 29/03/2008 à 0:24:57,81 ***
Merci - Roland
-
-
Contributeur sécuritébonjour, sur ton rapport perso je trouve une trentaine de ligne à fixxer surtour 5 ou 6 urgentes mais bonje vais laisser le soins à jorginho67 de tant faire la lecture puisque c'est lui qui te le demande , sinon dans bitdéfender désoler mais ils sont toujours dans ta messagerie Thunderbird je ne lutilise pas donc je ne peux pas te guider dans les démarches, trouve un tutoriel pour savoir comment purger les messages @+
-
Bonsoir Jacques,
Pour Thurnderbird je vais le désinstaller cela supprimera le profil et reglera le problème de messages infectés. Pour les lignes suivantes de bitdefender je ne sais pas quoi faire :
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll
Update failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Detected with: Application.Messenpass.B
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>xynx.hex
Update failed
Je pense que j'aurai plus vite fait de reformater mon disque dur et que cela résoudrait tous les problèmes ; qu'en penses-tu, cela fais 3 jours que je ne peux plus travailler, j'ai peur que les difficultés se multiplient !
Merci de ton aide et du temps que tu m'as consacré - Roland
-
-
Bonsoir,
Merci pour ton intervention, depuis cette dernière je galère dur, je ne sais plus si j'ai des écran de pub, mais lorsque j'ouvre thunderbird pour lire les messages du forum l'orid gèle il faut que je reboote, lorsque je veux télécharger les liens sont n'importe quoi, j'essaie de mettre sur le forum le rapport hijacthis, je vais peut-être y arriver ce coup-ci (profitons de que la machine ne regarde pas !)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:38:41, on 28/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\umonit.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.pianomajeur.net/forum/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers
communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program
Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program
Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program
Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: IeMonitorBho Class - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Ask Toolbar BHO - {F4D76F01-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - Toolbar: (no name) - {039036AA-7710-11D7-ACDA-00B0D094B576} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers
communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Policies\Explorer\Run: [{5400023B-0BBE-1036-1106-031127200021}] "C:\Program Files\Fichiers
communs\{5400023B-0BBE-1036-1106-031127200021}\Update.exe" mc-110-12-0000272
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp
Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add &Link to NewsPoint - res://C:\Program Files\Consenda\NewsPoint\Bin\NPHelper.dll/#201
O8 - Extra context menu item: Add &Page to NewsPoint - res://C:\Program Files\Consenda\NewsPoint\Bin\NPHelper.dll/#202
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: SYSTRAN: &Effacer le cache de traduction - C:\Program Files\Systran\Premium\menuClearCache.html
O8 - Extra context menu item: SYSTRAN: &Options - C:\Program Files\Systran\Premium\menuConfigure.html
O8 - Extra context menu item: SYSTRAN: &Traduire - C:\Program Files\Systran\Premium\menuTranslate.html
O8 - Extra context menu item: SYSTRAN: En®istrement - C:\Program Files\Systran\Premium\menuRegister.html
O8 - Extra context menu item: SYSTRAN: Rechercher les &mises à jour - C:\Program Files\Systran\Premium\menuUpdate.html
O8 - Extra context menu item: SYSTRAN: Traduire les &cadres - C:\Program Files\Systran\Premium\menuTranslateAll.html
O8 - Extra context menu item: Voir les cookies - C:\WINDOWS\web\showcookies.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky
Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: @sysiecom.dll,-2100 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuTranslate.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2102 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuTranslate.html
O9 - Extra button: @sysiecom.dll,-2103 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2105 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra button: @sysiecom.dll,-2115 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuConfigure.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2117 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuConfigure.html
O9 - Extra button: (no name) - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuClearCache.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2108 - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuClearCache.html
O9 - Extra button: (no name) - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuRegister.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2111 - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuRegister.html
O9 - Extra button: (no name) - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html
(file missing)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2114 - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program
Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} -
C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Launch NewsPoint - {b8c7FF31-8251-11d4-8a0c-00c04fbcb670} - C:\Program
Files\Consenda\NewsPoint\Bin\NewsPoint.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/SP.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) -
http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4F353BD-EB2A-48D5-A16D-3CECE127521A}: NameServer = 127.0.0.1,192.168.1.1,0.0.0.0
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus
7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers
communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program
Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra
Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra
Lite XI\RpcSandraSrv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony
Shared\AVLib\SPTISRV.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
Contributeur sécuritéSalut !
Essayons de voir çà !
Tu parles de pubs intempestives dans ton premier message.. Toujours pareil ?
Télécharge HIJACKTHIS <--- ici.
Enregistre HJTInstall.exe sur ton bureau. Double-clique sur HJTInstall.exe pour lancer le programme
Par défaut, il s'installera là : C:\Program Files\HijackThis\HijackThis.exe
Accepte la license en cliquant sur le bouton "I Accept"
Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Choisis l'option "Do a system scan and save a log file"
voir ici
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport
Comment fixer les lignes et générer un rapport <---- voir ici
Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement
IMPERATIF !! Avant de lancer HIJACKTHIS , il faut fermer tous les programmes ouverts, se déconnecter d' INTERNET !!
@+ -
Contributeur sécuritéaller bonne nuit si tu as fini tu poste et je regarde demain
-
Bonjour Jacques,
DELETE n'a rien delete, après un SmitfraudFix (analyse et nettoyage), voici le be scan bitdefender retour à la case départ (je n'ai scanné que la partie infectée), don le raport est le même que le premier que j'ai posté !
BitDefender Online Scanner
Scan report generated at: Fri, Mar 28, 2008 - 15:17:33
Scan path: C:\Documents and Settings;C:\My Download Files;
Statistics
Time
00:16:13
Files
64296
Folders
2755
Boot Sectors
9
Archives
10682
Packed Files
885
Results
Identified Viruses
7
Infected Files
7
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
7
Engines Info
Virus Definitions
957955
Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Scan plugins
14
Archive plugins
38
Unpack plugins
7
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Infected with: Generic.Peed.Eml.BE7DFC85
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Infected with: Generic.Peed.Eml.5DF70E7E
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Infected with: Generic.Peed.Eml.F071B358
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Infected with: Generic.Peed.Eml.E1EE7823
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk
Update failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll
Update failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Detected with: Application.Messenpass.B
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>xynx.hex
Update failed
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Infected with: Trojan.Keylogger.Hotkeyshook.A
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Disinfection failed
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Deleted
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar
Update failed
BitDefender Online Scanner
Scan report generated at: Fri, Mar 28, 2008 - 15:17:33
Scan path: C:\Documents and Settings;C:\My Download Files;
Statistics
Time
00:16:13
Files
64296
Folders
2755
Boot Sectors
9
Archives
10682
Packed Files
885
Results
Identified Viruses
7
Infected Files
7
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
7
Engines Info
Virus Definitions
957955
Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Scan plugins
14
Archive plugins
38
Unpack plugins
7
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Infected with: Generic.Peed.Eml.BE7DFC85
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Infected with: Generic.Peed.Eml.5DF70E7E
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Infected with: Generic.Peed.Eml.F071B358
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Infected with: Generic.Peed.Eml.E1EE7823
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk
Update failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll
Update failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Detected with: Application.Messenpass.B
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>xynx.hex
Update failed
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Infected with: Trojan.Keylogger.Hotkeyshook.A
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Disinfection failed
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Deleted
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar
Update failed
BitDefender Online Scanner
Scan report generated at: Fri, Mar 28, 2008 - 15:17:33
Scan path: C:\Documents and Settings;C:\My Download Files;
Statistics
Time
00:16:13
Files
64296
Folders
2755
Boot Sectors
9
Archives
10682
Packed Files
885
Results
Identified Viruses
7
Infected Files
7
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
7
Engines Info
Virus Definitions
957955
Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Scan plugins
14
Archive plugins
38
Unpack plugins
7
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Infected with: Generic.Peed.Eml.BE7DFC85
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Infected with: Generic.Peed.Eml.5DF70E7E
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Infected with: Generic.Peed.Eml.F071B358
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Infected with: Generic.Peed.Eml.E1EE7823
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk
Update failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll
Update failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Detected with: Application.Messenpass.B
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>xynx.hex
Update failed
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Infected with: Trojan.Keylogger.Hotkeyshook.A
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Disinfection failed
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Deleted
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar
Update failed
-
-
Contributeur sécuritési il faut continuer il est en train de les virer si tu lis les lignes elles se répètent et en dernier DELETED = supprimer
-
Bonsoir,
J'ai fait toutes les manip que tu m'as conseillé, je suis en train de faire un scan avec bitdefender et pour les 30 premières mintes j'ai les meme résultas que sur le premier rapport à savoir :
:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Infected with: Generic.Peed.Eml.BE7DFC85
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Infected with: Generic.Peed.Eml.5DF70E7E
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Infected with: Generic.Peed.Eml.F071B358
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Infected with: Generic.Peed.Eml.E1EE7823
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk
Update failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll
Update failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Detected with: Application.Messenpass.B
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>xynx.hex
Update failed
Il ya encore une heure de scan, cela vaut-il le coup de continuer
Merci -
bonsoir Jacques
D'abord merci, je vais commencer par effacer le contenue de toute ma messagerie car malgrès mes recherches je ne trouve pas, dans thurnderbird, les numéros de messages
Merci et à plus
Roland -
Contributeur sécuritébonjour, tu désactives la restauration sysème tu redémarres et tu la réactives http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020830101856924 et tu devrais supprimer ces messages (199,633,635,637) de ta boite de réception de thunderbird ainsi que la corbeille de ta boite de messagerie tu passes ccleaner dans c'est deux modes tu refais un scan en ligne en utilisant IE et pas mozilla si encore la tu passeras sdfix https://www.malekal.com/slenfbot-still-an-other-irc-bot/
-
Contributeur sécuritébonjour, passe malewarebytes https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ suivi de ccleaner dans ses deux modes nettoyeur et registre https://www.malekal.com/tutoriel-ccleaner/ et fais une analyse anti-virus en ligne en utilisant internet explorer http://www.commentcamarche.net/faq/sujet 8872 scanner en ligne avec bitdefender et poste le rapport si tu peux
-
Bonjour Jacques,
Voici le résultat du scan Bitdefender
Merci de ton aide
BitDefender Online Scanner
Scan report generated at: Thu, Mar 27, 2008 - 01:01:25
Scan path: A:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;
Statistics
Time
02:52:05
Files
562008
Folders
14360
Boot Sectors
9
Archives
14087
Packed Files
20571
Results
Identified Viruses
8
Infected Files
18
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
18
Engines Info
Virus Definitions
939560
Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Scan plugins
14
Archive plugins
38
Unpack plugins
7
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Infected with: Generic.Peed.Eml.BE7DFC85
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 633)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Infected with: Generic.Peed.Eml.5DF70E7E
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 635)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Infected with: Generic.Peed.Eml.F071B358
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox=>(message 637)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Inbox
Update failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Infected with: Generic.Peed.Eml.E1EE7823
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Disinfection failed
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk=>(message 199)
Deleted
C:\Documents and Settings\roland\Application Data\Thunderbird\Profiles\5nr9i1wy.default\Mail\pop.free.fr\Junk
Update failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>JDukeNative.dll
Update failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Detected with: Application.Messenpass.B
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Disinfection failed
C:\Documents and Settings\roland\Function.zip=>xynx.hex=>(Embedded EXE g)
Deleted
C:\Documents and Settings\roland\Function.zip=>xynx.hex
Update failed
C:\Documents and Settings\roland\JavaVirtualMachine.jar=>ProcThread.class
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\JavaVirtualMachine.jar=>ProcThread.class
Disinfection failed
C:\Documents and Settings\roland\JavaVirtualMachine.jar=>ProcThread.class
Deleted
C:\Documents and Settings\roland\JavaVirtualMachine.jar
Updated
C:\Documents and Settings\roland\JavaVirtualMachine.jar=>WinEnum.class
Infected with: Backdoor.KBD
C:\Documents and Settings\roland\JavaVirtualMachine.jar=>WinEnum.class
Disinfection failed
C:\Documents and Settings\roland\JavaVirtualMachine.jar=>WinEnum.class
Deleted
C:\Documents and Settings\roland\JavaVirtualMachine.jar
Updated
C:\Documents and Settings\roland\Mes documents\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Infected with: Trojan.Keylogger.Hotkeyshook.A
C:\Documents and Settings\roland\Mes documents\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Disinfection failed
C:\Documents and Settings\roland\Mes documents\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Deleted
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Infected with: Trojan.Keylogger.Hotkeyshook.A
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Disinfection failed
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar=>FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Deleted
C:\Documents and Settings\roland\Mes documents\My Downloads\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).rar
Update failed
C:\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Infected with: Trojan.Keylogger.Hotkeyshook.A
C:\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Disinfection failed
C:\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer)\FFF.Tomb.Raider.2.(US).V.1.1.(+3Trainer).exe
Deleted
C:\Program Files\DAP\Offers\spo3.exe
Infected with: Dropped:Trojan.Generic.84526
C:\Program Files\DAP\Offers\spo3.exe
Disinfection failed
C:\Program Files\DAP\Offers\spo3.exe
Deleted
C:\Program Files\Mozilla Firefox\JDukeNative.dll
Infected with: Backdoor.KBD
C:\Program Files\Mozilla Firefox\JDukeNative.dll
Disinfection failed
C:\Program Files\Mozilla Firefox\JDukeNative.dll
Deleted
C:\Program Files\Mozilla Firefox\User_Info.exe
Detected with: Application.Messenpass.B
C:\Program Files\Mozilla Firefox\User_Info.exe
Disinfection failed
C:\Program Files\Mozilla Firefox\User_Info.exe
Deleted
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165346.exe
Infected with: Trojan.Keylogger.Hotkeyshook.A
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165346.exe
Disinfection failed
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165346.exe
Deleted
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165347.exe
Infected with: Dropped:Trojan.Generic.84526
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165347.exe
Disinfection failed
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165347.exe
Deleted
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165349.dll
Infected with: Backdoor.KBD
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165349.dll
Disinfection failed
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165349.dll
Deleted
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165350.exe
Detected with: Application.Messenpass.B
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165350.exe
Disinfection failed
C:\System Volume Information\_restore{949317DC-9F61-4235-9B7B-F3C01401D2F9}\RP590\A0165350.exe
Deleted
-
-
google - adblock plus
