Fenetre pop up
Résolu
Bonjour,
il se trouve que j'ai une fenetre qui pop me disant que mon ordi est infecté de spywares et qu'il va scanner mon pc gratuit....bla bla bla...quand je scan avec spybot il ne détecte rien.Devrais-je m'inquiéter?merci de vos réponses!marie-douce12
il se trouve que j'ai une fenetre qui pop me disant que mon ordi est infecté de spywares et qu'il va scanner mon pc gratuit....bla bla bla...quand je scan avec spybot il ne détecte rien.Devrais-je m'inquiéter?merci de vos réponses!marie-douce12
Configuration: Windows XP Firefox 2.0.0.13
60 réponses
Résumé de la discussion
Une fenêtre d'alerte affirme qu'un PC est infecté par des spywares et propose un scan gratuit, mais Spybot ne détecte rien, ce qui suggère une arnaque ou du scareware. Plusieurs contributeurs évoquent une piste possible liée à des infections comme Vundo et recommandent des outils de nettoyage spécifiques pour Windows XP afin d'éviter les fausses alertes et d'éliminer les éventuels logiciels malveillants. En cas de doute, éviter de suivre les alertes et réaliser des balayages complémentaires avec des outils reconnus; ensuite supprimer les éléments suspects et restreindre les sessions partagées pour limiter les risques.
-
Contributeur sécuritéTchouss Marie !!!
-
bon ca y est !!!!je te remercie infiniment de ta patience et vais tacher de faire tout en mon possible pour garder le tout propre et a jour!!!;)))marie-douce12
-
Contributeur sécuritésalut,
tout est OK ... Enfin !
Supprime tout ce que AntiVir a en quarantaine .
Télécharge ToolsCleaner (de A.Rothstein) sur ton Bureau.
http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
Clique sur Recherche et laisse le scan se terminer (cela peut-être un peut long )
Clique sur Suppression pour finaliser.
tu peux, si tu le souhaites, te servir des Options facultatives
se petit soft va te nettoyer tout les trucs dont on c'est servi pour la désinfection ( tu n'en as plus besion ! ) .
Supprimes tout les outils , dossiers ou rapports consernant la désinfection que Toolsclaener2 n'a pas supprimé .
Puis enfin supprimes Toolscleaner2 ...
Un bon coup de CCleaner (registre compris) .
Refait ce-ci :
1-Restauration système :
--->Désactive ta restauration :
Clique droit sur poste de travail/propriétés/coche la case désactiver la restauration, appliquer, OK
Redémarre ton PC .
--->Réactive ta restauration :
Clique droit sur poste de travail/propriétés/décoche la case désactiver la restauration, appliquer, OK
Redémarre ton PC .
2-Défragmentation
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général"
--->"défragmenter maintenant", OK
une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK
tu le fais pour chacun de tes disques .
une fois cela terminer :
3-Crées un nouveau point de restauration de ton PC :
Aller dans le Menu Démarrer puis dans Programmes,
- Ensuite dans Accessoires et enfin dans Outils système,
- Choisir Restauration du système,
- Sélectionner Créer un point de restauration,
- Cliquer sur Suivant,
- Entrer un nom pour le point de restauration : ce nom doit être assez évocateur,
- Cliquer sur Créer et le point de restauration se créé automatiquement.
Si tu n'a plus d'autres souci ... J'ESPERE BIEN que cette fois ci, c'est la bonne ...
Conseil : tu peut maintenant faire plusieurs sessions ... Mais chacun son PC se serai mieux , surtout si : je partage cet ordi avec quelqun qui va souvent télécharger sur les sites de torrents et que personne ne s'occupe vraiment des défences du PC ( mises à jours des anti-virus et autres , scan du PC ,ect...) .
Je te dis bye et bonne continuation à toi ... ;) -
voila pour le scan antivir!!!bonne nuit!a demain;)
Avira AntiVir Personal
Report file date: 24 avril 2008 21:21
Scanning for 1236771 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: ORDI
Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 2008-04-09 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 2008-03-18 16:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 2008-02-07 15:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 2008-02-28 15:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 2008-02-21 15:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 17:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 2008-03-07 20:08:58
ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 2008-04-22 04:12:45
ANTIVIR3.VDF : 7.0.3.210 113664 Bytes 2008-04-24 02:20:56
Engineversion : 8.1.0.32
AEVDF.DLL : 8.1.0.5 102772 Bytes 2008-02-25 16:58:21
AESCRIPT.DLL : 8.1.0.26 233850 Bytes 2008-04-23 04:12:57
AESCN.DLL : 8.1.0.14 119156 Bytes 2008-04-23 04:12:55
AERDL.DLL : 8.1.0.19 418164 Bytes 2008-04-07 22:34:44
AEPACK.DLL : 8.1.1.2 364917 Bytes 2008-04-23 04:12:55
AEOFFICE.DLL : 8.1.0.18 192890 Bytes 2008-04-23 04:12:53
AEHEUR.DLL : 8.1.0.18 1167735 Bytes 2008-04-23 04:12:52
AEHELP.DLL : 8.1.0.14 115063 Bytes 2008-04-23 04:12:49
AEGEN.DLL : 8.1.0.17 299380 Bytes 2008-04-23 04:12:48
AEEMU.DLL : 8.1.0.5 430450 Bytes 2008-04-07 22:34:43
AECORE.DLL : 8.1.0.27 168310 Bytes 2008-04-23 04:12:46
AVWINLL.DLL : 1.0.0.7 14593 Bytes 2008-01-24 00:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 2008-02-18 17:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 20:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 2008-01-24 00:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 2008-02-12 15:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2008-02-28 15:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008-01-23 00:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 2008-01-24 00:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 2008-01-25 19:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 2008-03-10 21:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 2008-03-06 19:02:11
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: 24 avril 2008 21:21
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'hpqgalry.exe' - '1' Module(s) have been scanned
Scan process 'YzShadow.exe' - '1' Module(s) have been scanned
Scan process 'UberIcon Manager.exe' - '1' Module(s) have been scanned
Scan process 'RocketDock.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'CTLCMgr.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'Corel Photo Downloader.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'CTSched.exe' - '1' Module(s) have been scanned
Scan process 'V0230Mon.exe' - '1' Module(s) have been scanned
Scan process 'StartFX.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'PSIService.exe' - '1' Module(s) have been scanned
Scan process 'SweetIM.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'ATKKBService.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
55 processes with 55 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '29' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Kat\Bureau\bureau\Sécurité et nettoyage\Navilog1.exe
[DETECTION] Contains detection pattern of the dropper DR/Tool.Reboot.F.82
[NOTE] The file was moved to '488742b6.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <autresd>
Begin scan in 'E:\' <Storage>
End of the scan: 24 avril 2008 21:57
Used time: 36:07 min
The scan has been done completely.
11946 Scanning directories
317704 Files were scanned
1 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
1 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
317703 Files not concerned
2593 Archives were scanned
3 Warnings
1 Notes
our le scan antivir:a demain;) -
Contributeur sécuritébien ... maintenant fait exactement ce qui suit ( cela risque d'être un peu long ...)
1-Restauration système :
--->Désactive ta restauration :
Clique droit sur poste de travail/propriétés/coche la case désactiver la restauration, appliquer, OK
Redémarre ton PC .
--->Réactive ta restauration :
Clique droit sur poste de travail/propriétés/décoche la case désactiver la restauration, appliquer, OK
Redémarre ton PC .
2-Nettoyage :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général"
Clique sur le bouton "nettoyage de disque", OK
tu le fais pour chacun de tes disques ( je pense au E\:)
3-Vérifications des erreurs :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil"
"Vérifier maintenant", une boîte s'ouvre, cocher les cases
réparer automatiquement les erreurs...
rechercher et tenter une récupération...
Démarrer, ok
s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal
tu le fais pour chacun de tes disques ( je pense au E\:)
Une fois tout cela fait , relance un scan avec AntiVir et postes le dernier rapport obtenue ...
J'attends tout ces résultats demain ... Tchouss Marie ;)
-
voila c fait!
-
Contributeur sécuritéOK ....
je voudrais que tu faces ce-ci :
Crées un point de restauration de ton PC :
Aller dans le Menu Démarrer puis dans Programmes,
- Ensuite dans Accessoires et enfin dans Outils système,
- Choisir Restauration du système,
- Sélectionner Créer un point de restauration,
- Cliquer sur Suivant,
- Entrer un nom pour le point de restauration : ce nom doit être assez évocateur,
- Cliquer sur Créer et le point de restauration se créé automatiquement.
préviens moi dès que cela est fait ... -
je tombe dans le storage...
-
Contributeur sécuritéQuand dans poste de travaille tu clik sur E\: où tombes tu ?
-
E:storage
-
Contributeur sécuritéE:\ ---> à quoi correspond-t-il svp ? disk dur esclave , lecteur DVD ? ...
-
File/Folder E:\films kat\winzip checksum.exe not found.
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04242008_184655 -
Contributeur sécuritéclick double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
E:\films kat\winzip checksum.exe
et colles-la dans le cadre de gauche de OTMoveIt2 :
Paste standard List of Files/Folders to be moved.
cliques sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.
cliques sur Exit pour fermer.
postes le rapport situé dans C:\\\_OTMoveIt\MovedFiles.
il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
si c'est le cas acceptes par "Yes".
-
voila :
[04/24/2008, 18:27:26] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Kat\Bureau\VirtumundoBeGone.exe" )
[04/24/2008, 18:27:31] - Detected System Information:
[04/24/2008, 18:27:31] - Windows Version: 5.1.2600, Service Pack 2
[04/24/2008, 18:27:31] - Current Username: Kat (Admin)
[04/24/2008, 18:27:31] - Windows is in SAFE mode with Networking.
[04/24/2008, 18:27:31] - Searching for Browser Helper Objects:
[04/24/2008, 18:27:31] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/24/2008, 18:27:31] - BHO 2: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
[04/24/2008, 18:27:31] - BHO 3: {40FB69E1-9B7B-453F-B238-37D8E9528929} (SIPAKBHO Class)
[04/24/2008, 18:27:31] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/24/2008, 18:27:31] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[04/24/2008, 18:27:31] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[04/24/2008, 18:27:31] - Finished Searching Browser Helper Objects
[04/24/2008, 18:27:31] - Finishing up...
[04/24/2008, 18:27:31] - Nothing found! Exiting...
et le hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:34:48, on 2008-04-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\WINDOWS\system32\V0230Mon.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://get2.adobe.com/reader/otherversions/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: AdsCleaner Helper - {40FB69E1-9B7B-453F-B238-37D8E9528929} - C:\Program Files\SoftInform\AdsCleaner Trial\PAKIEPlugins.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: AdsCleaner Links Bar - {A8415B7A-F661-4D31-92D7-4398E50483DF} - C:\PROGRA~1\SOFTIN~1\ADSCLE~1\PAKIEGUI.dll
O3 - Toolbar: AdsCleaner Bar - {75CD0BC5-E317-449C-9FF6-4986B3D48F64} - C:\PROGRA~1\SOFTIN~1\ADSCLE~1\PAKIEGUI.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\system32\V0230Mon.exe
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AdsCleaner Bar - {B5D8F853-BEC9-4F9C-B3C9-0F744B6869D1} - C:\PROGRA~1\SOFTIN~1\ADSCLE~1\PAKIEGUI.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
-
Contributeur sécuritéen attendant ,
redémarre ton PC en mode sans échec :
Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau , postes le.
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).
puis ensuite, fait un autre scan monjack et postes le aussi . -
Contributeur sécuritéAttend pour la suite , je vais demander un coup de main ...
-
voila le scan antivir:
Avira AntiVir Personal
Report file date: 23 avril 2008 20:26
Scanning for 1229906 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: ORDI
Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 2008-04-09 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 2008-03-18 16:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 2008-02-07 15:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 2008-02-28 15:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 2008-02-21 15:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 17:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 2008-03-07 20:08:58
ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 2008-04-22 04:12:45
ANTIVIR3.VDF : 7.0.3.200 13824 Bytes 2008-04-22 04:12:45
Engineversion : 8.1.0.32
AEVDF.DLL : 8.1.0.5 102772 Bytes 2008-02-25 16:58:21
AESCRIPT.DLL : 8.1.0.26 233850 Bytes 2008-04-23 04:12:57
AESCN.DLL : 8.1.0.14 119156 Bytes 2008-04-23 04:12:55
AERDL.DLL : 8.1.0.19 418164 Bytes 2008-04-07 22:34:44
AEPACK.DLL : 8.1.1.2 364917 Bytes 2008-04-23 04:12:55
AEOFFICE.DLL : 8.1.0.18 192890 Bytes 2008-04-23 04:12:53
AEHEUR.DLL : 8.1.0.18 1167735 Bytes 2008-04-23 04:12:52
AEHELP.DLL : 8.1.0.14 115063 Bytes 2008-04-23 04:12:49
AEGEN.DLL : 8.1.0.17 299380 Bytes 2008-04-23 04:12:48
AEEMU.DLL : 8.1.0.5 430450 Bytes 2008-04-07 22:34:43
AECORE.DLL : 8.1.0.27 168310 Bytes 2008-04-23 04:12:46
AVWINLL.DLL : 1.0.0.7 14593 Bytes 2008-01-24 00:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 2008-02-18 17:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 20:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 2008-01-24 00:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 2008-02-12 15:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2008-02-28 15:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008-01-23 00:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 2008-01-24 00:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 2008-01-25 19:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 2008-03-10 21:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 2008-03-06 19:02:11
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: 23 avril 2008 20:26
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'YzShadow.exe' - '1' Module(s) have been scanned
Scan process 'UberIcon Manager.exe' - '1' Module(s) have been scanned
Scan process 'RocketDock.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'hpqgalry.exe' - '1' Module(s) have been scanned
Scan process 'CTLCMgr.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'Corel Photo Downloader.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'CTSched.exe' - '1' Module(s) have been scanned
Scan process 'V0230Mon.exe' - '1' Module(s) have been scanned
Scan process 'StartFX.exe' - '1' Module(s) have been scanned
Scan process 'SweetIM.exe' - '1' Module(s) have been scanned
Scan process 'CLI.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'PSIService.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'ATKKBService.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
54 processes with 54 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '27' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <autresd>
Begin scan in 'E:\' <Storage>
E:\System Volume Information\_restore{5C8DEE82-5E54-4DFF-8308-471B28D22313}\RP158\A0031427.exe
[0] Archive type: RAR SFX (self extracting)
--> winzip checksum.exe
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26001
[WARNING]
End of the scan: 24 avril 2008 10:22
Used time: 13:56:11 min
The scan has been done completely.
12227 Scanning directories
338177 Files were scanned
1 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
338176 Files not concerned
2599 Archives were scanned
4 Warnings
0 Notes -
Contributeur sécuritétrès bien ...
Un coup de CCleaner ( registre compris )
Relances un scan avec AntiVir pour voir ce qui reste de Vundo ...
Postes le rapport qui sera générer ... -
C:\WINDOWS\system32\tajnloyb.ini moved successfully.
C:\WINDOWS\system32\kemdceqf.ini moved successfully.
C:\WINDOWS\system32\qdjpvdgf.ini moved successfully.
C:\WINDOWS\system32\qufelgmr.ini moved successfully.
C:\WINDOWS\system32\dixhefte.ini moved successfully.
C:\WINDOWS\system32\fnfhesfk.ini moved successfully.
C:\WINDOWS\system32\lqejrpsy.ini moved successfully.
C:\WINDOWS\system32\nhbefyuv.ini moved successfully.
File/Folder not found.
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04232008_201411 -
Contributeur sécuritéTélécharge OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
clic double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
C:\WINDOWS\system32\tajnloyb.ini
C:\WINDOWS\system32\kemdceqf.ini
C:\WINDOWS\system32\qdjpvdgf.ini
C:\WINDOWS\system32\qufelgmr.ini
C:\WINDOWS\system32\dixhefte.ini
C:\WINDOWS\system32\fnfhesfk.ini
C:\WINDOWS\system32\lqejrpsy.ini
C:\WINDOWS\system32\nhbefyuv.ini
et colles-la dans le cadre de gauche de OTMoveIt2 :
Paste standard List of Files/Folders to be moved.
cliques sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.
cliques sur Exit pour fermer.
postes le rapport situé dans C:\\\_OTMoveIt\MovedFiles.
il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
si c'est le cas acceptes par "Yes".
- 1
- 2
- 3
Suivant
