Warning! Security report Résolu

Question

Bonjour,

J'ai un message a côté de l'heure qui marque Warning Security report  et m'annonce que mon ordiest infecté par de spyware!!

J'espère que vour porrez m'aider.

Merci d'avance!!

SmitFraudFix v2.323

Rapport fait à 12:17:52,53, 2008-06-11
Executé à partir de C:\Documents and Settings\Admin\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Hide My IP 2007\SecureSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Admin\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"IPC Configuration Utility"="IPC Configuration Utility"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{020487CC-FC04-4B1E-863F-D9801796230B}"="Windows Installer Class"

[HKEY_CLASSES_ROOT\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\Admin\LOCALS~1\Temp\wndutl32.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\Admin\LOCALS~1\Temp\wndutl32.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: SiS 900 PCI Fast Ethernet Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.2.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{FC8D83DF-1A37-49B6-9495-414E12F6A727}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FC8D83DF-1A37-49B6-9495-414E12F6A727}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FC8D83DF-1A37-49B6-9495-414E12F6A727}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

Telecharge malwarebytes 

-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu l´instale; le programme va se mettre automatiquement a jour. 

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet". 

Puis click sur "rechercher". 

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection. 

si il t´es demandé de redemarrer > click sur "yes". 

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 

Copie et colle le rapport stp.

ps : les rapport sont aussi rangé dans l onglet rapport/log

Anthonyz · Answer

ComboFix 08-06-10.5 - Admin 2008-06-11 16:54:43.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.577 [GMT -4:00]
Endroit: C:\Documents and Settings\Admin\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\rapidhacker.dll
C:\upload_moi_ACER-9604116340.tar.gz
C:\WINDOWS\mozver.dat
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\mlJYrsPi.dll
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\rvifybry.dll
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\BoontyGames
C:\rapidhacker.dll
C:\upload_moi_ACER-9604116340.tar.gz
C:\WINDOWS\mozver.dat
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\mlJYrsPi.dll
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\rvifybry.dll
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-11 to 2008-06-11 ))))))))))))))))))))))))))))))))))))
.

2008-06-11 16:17 . 2008-06-11 16:17 <REP> d-------- C:\WINDOWS\LastGood
2008-06-11 13:22 . 2008-06-11 13:22 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-11 13:22 . 2008-06-11 13:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-11 13:22 . 2008-06-11 13:22 <REP> d-------- C:\Documents and Settings\Admin\Application Data\Malwarebytes
2008-06-11 13:22 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-11 13:22 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-11 12:18 . 2008-06-11 12:46 4,390 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-09 21:48 . 2008-06-09 21:48 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-09 21:48 . 2008-06-09 22:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-09 21:01 . 2008-06-09 21:01 <REP> d-------- C:\Program Files\Ratajik Software
2008-06-09 20:28 . 2008-06-09 20:38 <REP> d-------- C:\Program Files\Nexus Radio
2008-06-09 19:28 . 2008-06-09 19:28 <REP> d-------- C:\Archivos de programa
2008-06-09 19:26 . 2008-05-16 12:00 <REP> d-------- C:\Program Files\Serials 2000 7.1.5 Plus
2008-06-09 16:16 . 2008-06-11 16:37 <REP> d-------- C:\Program Files\Virtual Piano
2008-06-09 00:02 . 2008-06-09 00:03 <REP> d-------- C:\Program Files\Hide My IP 2007
2008-06-09 00:02 . 2007-12-03 03:13 888,832 --a------ C:\WINDOWS\system32\securenet.dll
2008-06-08 22:53 . 2008-06-08 22:53 32 --a------ C:\WINDOWS\go
2008-05-17 09:58 . 2008-05-17 09:58 <REP> d-------- C:\Program Files\My Downloaded Games
2008-05-17 08:42 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-05-16 15:55 . 2008-05-16 15:55 <REP> d-------- C:\Program Files\Microsoft Works
2008-05-16 15:54 . 2008-05-16 15:54 <REP> d-------- C:\Program Files\Microsoft.NET
2008-05-16 15:51 . 2008-05-16 15:55 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-05-16 15:47 . 2008-05-16 15:47 <REP> dr-h----- C:\MSOCache
2008-05-15 22:33 . 2008-05-15 22:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-05-15 22:25 . 2008-05-17 02:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-15 20:34 . 2008-05-15 20:34 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-05-12 08:26 . 2008-06-11 16:08 <REP> d-------- C:\Temp
2008-05-12 08:08 . 2008-05-12 08:08 0 --a------ C:\WINDOWS\sms.INI
2008-05-12 08:07 . 2008-05-12 08:07 <REP> d-------- C:\My Music
2008-05-11 21:21 . 2008-06-05 12:58 <REP> d-------- C:\Program Files\FrostWire
2008-05-11 21:21 . 2008-06-08 21:12 <REP> d-------- C:\Documents and Settings\Admin\Shared
2008-05-11 21:21 . 2008-06-08 22:15 <REP> d-------- C:\Documents and Settings\Admin\Incomplete
2008-05-11 21:21 . 2008-05-15 22:26 <REP> d-------- C:\Documents and Settings\Admin\Application Data\FrostWire
2008-05-11 20:41 . 2008-05-11 20:42 <REP> d-------- C:\Program Files\Samsung

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 01:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-17 12:41 --------- d-----w C:\Program Files\Creative
2008-05-12 01:21 --------- d-----w C:\Program Files\LimeWire
2008-05-12 00:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 15:05 --------- d-----w C:\Documents and Settings\Admin\Application Data\LimeWire
2008-05-10 15:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-10 15:00 --------- d-----w C:\Documents and Settings\Admin\Application Data\AdobeUM
2008-05-10 06:44 --------- d-----w C:\Program Files\silence on tourne
2008-05-10 06:19 --------- d-----w C:\Documents and Settings\Admin\Application Data\Creative
2008-05-10 06:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-05-10 05:39 --------- d--h--w C:\Program Files\Creative Installation Information
2008-05-10 05:37 --------- d-----w C:\Program Files\Fichiers communs\Creative
2008-05-10 04:43 --------- d-----w C:\Documents and Settings\Admin\Application Data\Kazaa Lite
2008-05-10 03:51 --------- d-----w C:\Documents and Settings\Admin\Application Data\DivX
2008-05-09 23:41 --------- d-----w C:\Documents and Settings\Admin\Application Data\Apple Computer
2008-05-09 15:29 --------- d-----w C:\Documents and Settings\Admin\Application Data\Sony Corporation
2008-05-08 16:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\MotiveSysIDs
2008-05-08 16:00 314 ----a-w C:\Program Files\INSTALL.LOG
2008-05-08 02:58 --------- d-----w C:\Program Files\Common Files
2008-05-08 02:58 --------- d-----w C:\Documents and Settings\Admin\Application Data\Nexon
2008-05-08 02:56 --------- d-----w C:\Program Files\DivX
2008-05-08 01:02 155,995 ----a-w C:\WINDOWS\java\Packages\NNJP3T3T.ZIP
2008-05-08 01:00 --------- d-----w C:\Program Files\Fichiers communs\Motive
2008-05-08 01:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Motive
2008-04-25 22:03 --------- d-----w C:\Program Files\Google
2008-04-16 21:05 --------- d-----w C:\Program Files\Xmots98
2008-04-16 21:05 --------- d-----w C:\Program Files\Myst III Exile
2008-04-16 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
2008-04-16 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Borland
2008-04-16 20:59 --------- d-----w C:\Program Files\WordPerfect OfficeReady 1.5
2008-04-16 20:56 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2008-04-16 20:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-04-16 20:38 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-16 20:38 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-16 20:37 --------- d-----w C:\Program Files\Windows Live
2008-04-16 19:57 --------- d-----w C:\Documents and Settings\Admin\Application Data\MSNInstaller
2008-04-16 19:48 --------- d-----w C:\Program Files\L'Amerzone
2008-04-16 19:47 --------- d-----w C:\Program Files\Jeune Styliste 2
2008-04-16 19:46 --------- d-----w C:\Program Files\Jeune Styliste
2008-04-16 19:46 --------- d-----w C:\Program Files\Canon
2008-04-16 19:45 --------- d-----w C:\Documents and Settings\k\Application Data\Canon
2008-04-16 19:16 --------- d-----w C:\Documents and Settings\k\Application Data\OpenOffice.org2
2008-04-14 13:09 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-04-12 19:18 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-03-21 20:30 120,056 ------w C:\WINDOWS\system32\PxCpyI64.exe
2008-03-21 20:30 118,520 ------w C:\WINDOWS\system32\PxInsI64.exe
2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2007-02-06 23:42 1,398,352 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
2007-02-02 04:52 80 --sh--r C:\WINDOWS\system32\870D8849F9.dll
2007-10-28 22:36 168 --sh--r C:\WINDOWS\system32\F949880D87.sys
.

((((((((((((((((((((((((((((( snapshot@2008-06-11_16.14.17.12 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 01:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 11:03 868352]
"DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-06-05 10:48 2113360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 01:00 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-11 15:35:31 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2006-08-07 13:40:32 262144]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\FrostWire\\FrostWire.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 14:47]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 19:20]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-07-06 17:06]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 19:16]
R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-06-01 12:41]
R3 SecureSrv;SecureSrv;C:\Program Files\Hide My IP 2007\SecureSrv.exe [2007-12-18 11:22]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 01:00]
S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\YH-925.sys [2004-06-24 13:52]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-12 11:42:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-11 20:55:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{4E30322B-F709-43A0-9587-596D13591BCF}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 16:55:42
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\securenet.dll
.
Temps d'accomplissement: 2008-06-11 16:56:19
ComboFix-quarantined-files.txt 2008-06-11 20:56:09
ComboFix2.txt 2008-06-11 20:14:34

Pre-Run: 47,615,229,952 octets libres
Post-Run: 47,604,932,608 octets libres

224 --- E O F --- 2008-06-06 04:49:17

+

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:02:16, on 2008-06-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Hide My IP 2007\SecureSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Admin\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {2fb5b67a-05e1-4cb5-997d-55f1ef650fe6} - (no file)
O2 - BHO: (no name) - {3CC068A5-8E60-4D5A-99EC-44A60E7CBD13} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7F7DAAD8-D1A0-46C3-8134-7FAAE453D4A4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A0B4FFEA-D466-49A8-9BB0-B7BBD2FCB449} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/piczo_fast_uploader.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} (SpiderSolitaire Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.xfinity.com
O20 - Winlogon Notify: yayvWqnl - C:\WINDOWS\
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file)
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SecureSrv - Unknown owner - C:\Program Files\Hide My IP 2007\SecureSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Utilisateur anonyme · Answer

ok refais un scan hijackthis et post le rapport stp

ensuite je regarde tout ça et te dis la suite

Anthonyz · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:20:01, on 2008-06-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Hide My IP 2007\SecureSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Admin\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {3CC068A5-8E60-4D5A-99EC-44A60E7CBD13} - C:\WINDOWS\system32\mlJYrsPi.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MotiveReportAgent] "C:\Program Files\Fichiers communs\Motive\McciBootStrapper.exe" /url="-url=file://C:\Program Files\Fichiers communs\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath="C:\Program Files\Common Files\Motive\motivebrowser.exe" /hidden
O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [BM2750db57] Rundll32.exe "C:\WINDOWS\system32vifybry.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/piczo_fast_uploader.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} (SpiderSolitaire Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.xfinity.com
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file)
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SecureSrv - Unknown owner - C:\Program Files\Hide My IP 2007\SecureSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Utilisateur anonyme · Answer

dis moi si tu connai ce programme : Hide My IP 2007

Anthonyz · Answer

oui pourquoi?

Utilisateur anonyme · Answer

pour savoir .... Je te dis la suite (10 min)

Utilisateur anonyme · Answer

Copie le texte ci-dessous : 


File:: 
C:\upload_moi_ACER-9604116340.tar.gz 
C:\WINDOWS\system32\VCCLSID.exe 
C:\WINDOWS\system32\SrchSTS.exe 
C:\WINDOWS\system32\VACFix.exe 
C:\WINDOWS\system32\IEDFix.exe 
C:\WINDOWS\system32\404Fix.exe 
C:\WINDOWS\system32\Process.exe 
C:\WINDOWS\system32\dumphive.exe 
C:\WINDOWS\system32\WS2Fix.exe 
C:\WINDOWS\system32\rvifybry.dll 
C:\rapidhacker.dll 
C:\WINDOWS\mozver.dat 
C:\WINDOWS\system32\mlJYrsPi.dll 
C:\WINDOWS\system32\rvifybry.dll

Folder:: 
C:\Program Files\BoontyGames 

Registry:: 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2fb5b67a-05e1-4cb5-997d-55f1ef650fe6}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CC068A5-8E60-4D5A-99EC-44A60E7CBD13}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F7DAAD8-D1A0-46C3-8134-7FAAE453D4A4}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0B4FFEA-D466-49A8-9BB0-B7BBD2FCB449}] 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"BM2750db57"=-





Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
Sauvegarde ce fichier sous le nom de CFScript.txt. 

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous : 

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis. 

S'il n'y a pas de rédémarrage, poste quand même les rapports.

Anthonyz · Answer

ComboFix 08-06-10.5 - Admin 2008-06-11 16:54:43.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.577 [GMT -4:00]
Endroit: C:\Documents and Settings\Admin\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\rapidhacker.dll
C:\upload_moi_ACER-9604116340.tar.gz
C:\WINDOWS\mozver.dat
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\mlJYrsPi.dll
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\rvifybry.dll
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\BoontyGames
C:\rapidhacker.dll
C:\upload_moi_ACER-9604116340.tar.gz
C:\WINDOWS\mozver.dat
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\mlJYrsPi.dll
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\rvifybry.dll
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-11 to 2008-06-11 ))))))))))))))))))))))))))))))))))))
.

2008-06-11 16:17 . 2008-06-11 16:17 <REP> d-------- C:\WINDOWS\LastGood
2008-06-11 13:22 . 2008-06-11 13:22 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-11 13:22 . 2008-06-11 13:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-11 13:22 . 2008-06-11 13:22 <REP> d-------- C:\Documents and Settings\Admin\Application Data\Malwarebytes
2008-06-11 13:22 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-11 13:22 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-11 12:18 . 2008-06-11 12:46 4,390 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-09 21:48 . 2008-06-09 21:48 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-09 21:48 . 2008-06-09 22:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-09 21:01 . 2008-06-09 21:01 <REP> d-------- C:\Program Files\Ratajik Software
2008-06-09 20:28 . 2008-06-09 20:38 <REP> d-------- C:\Program Files\Nexus Radio
2008-06-09 19:28 . 2008-06-09 19:28 <REP> d-------- C:\Archivos de programa
2008-06-09 19:26 . 2008-05-16 12:00 <REP> d-------- C:\Program Files\Serials 2000 7.1.5 Plus
2008-06-09 16:16 . 2008-06-11 16:37 <REP> d-------- C:\Program Files\Virtual Piano
2008-06-09 00:02 . 2008-06-09 00:03 <REP> d-------- C:\Program Files\Hide My IP 2007
2008-06-09 00:02 . 2007-12-03 03:13 888,832 --a------ C:\WINDOWS\system32\securenet.dll
2008-06-08 22:53 . 2008-06-08 22:53 32 --a------ C:\WINDOWS\go
2008-05-17 09:58 . 2008-05-17 09:58 <REP> d-------- C:\Program Files\My Downloaded Games
2008-05-17 08:42 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-05-16 15:55 . 2008-05-16 15:55 <REP> d-------- C:\Program Files\Microsoft Works
2008-05-16 15:54 . 2008-05-16 15:54 <REP> d-------- C:\Program Files\Microsoft.NET
2008-05-16 15:51 . 2008-05-16 15:55 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-05-16 15:47 . 2008-05-16 15:47 <REP> dr-h----- C:\MSOCache
2008-05-15 22:33 . 2008-05-15 22:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-05-15 22:25 . 2008-05-17 02:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-15 20:34 . 2008-05-15 20:34 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-05-12 08:26 . 2008-06-11 16:08 <REP> d-------- C:\Temp
2008-05-12 08:08 . 2008-05-12 08:08 0 --a------ C:\WINDOWS\sms.INI
2008-05-12 08:07 . 2008-05-12 08:07 <REP> d-------- C:\My Music
2008-05-11 21:21 . 2008-06-05 12:58 <REP> d-------- C:\Program Files\FrostWire
2008-05-11 21:21 . 2008-06-08 21:12 <REP> d-------- C:\Documents and Settings\Admin\Shared
2008-05-11 21:21 . 2008-06-08 22:15 <REP> d-------- C:\Documents and Settings\Admin\Incomplete
2008-05-11 21:21 . 2008-05-15 22:26 <REP> d-------- C:\Documents and Settings\Admin\Application Data\FrostWire
2008-05-11 20:41 . 2008-05-11 20:42 <REP> d-------- C:\Program Files\Samsung

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 01:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-17 12:41 --------- d-----w C:\Program Files\Creative
2008-05-12 01:21 --------- d-----w C:\Program Files\LimeWire
2008-05-12 00:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 15:05 --------- d-----w C:\Documents and Settings\Admin\Application Data\LimeWire
2008-05-10 15:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-10 15:00 --------- d-----w C:\Documents and Settings\Admin\Application Data\AdobeUM
2008-05-10 06:44 --------- d-----w C:\Program Files\silence on tourne
2008-05-10 06:19 --------- d-----w C:\Documents and Settings\Admin\Application Data\Creative
2008-05-10 06:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-05-10 05:39 --------- d--h--w C:\Program Files\Creative Installation Information
2008-05-10 05:37 --------- d-----w C:\Program Files\Fichiers communs\Creative
2008-05-10 04:43 --------- d-----w C:\Documents and Settings\Admin\Application Data\Kazaa Lite
2008-05-10 03:51 --------- d-----w C:\Documents and Settings\Admin\Application Data\DivX
2008-05-09 23:41 --------- d-----w C:\Documents and Settings\Admin\Application Data\Apple Computer
2008-05-09 15:29 --------- d-----w C:\Documents and Settings\Admin\Application Data\Sony Corporation
2008-05-08 16:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\MotiveSysIDs
2008-05-08 16:00 314 ----a-w C:\Program Files\INSTALL.LOG
2008-05-08 02:58 --------- d-----w C:\Program Files\Common Files
2008-05-08 02:58 --------- d-----w C:\Documents and Settings\Admin\Application Data\Nexon
2008-05-08 02:56 --------- d-----w C:\Program Files\DivX
2008-05-08 01:02 155,995 ----a-w C:\WINDOWS\java\Packages\NNJP3T3T.ZIP
2008-05-08 01:00 --------- d-----w C:\Program Files\Fichiers communs\Motive
2008-05-08 01:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Motive
2008-04-25 22:03 --------- d-----w C:\Program Files\Google
2008-04-16 21:05 --------- d-----w C:\Program Files\Xmots98
2008-04-16 21:05 --------- d-----w C:\Program Files\Myst III Exile
2008-04-16 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
2008-04-16 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Borland
2008-04-16 20:59 --------- d-----w C:\Program Files\WordPerfect OfficeReady 1.5
2008-04-16 20:56 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2008-04-16 20:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-04-16 20:38 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-16 20:38 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-16 20:37 --------- d-----w C:\Program Files\Windows Live
2008-04-16 19:57 --------- d-----w C:\Documents and Settings\Admin\Application Data\MSNInstaller
2008-04-16 19:48 --------- d-----w C:\Program Files\L'Amerzone
2008-04-16 19:47 --------- d-----w C:\Program Files\Jeune Styliste 2
2008-04-16 19:46 --------- d-----w C:\Program Files\Jeune Styliste
2008-04-16 19:46 --------- d-----w C:\Program Files\Canon
2008-04-16 19:45 --------- d-----w C:\Documents and Settings\k\Application Data\Canon
2008-04-16 19:16 --------- d-----w C:\Documents and Settings\k\Application Data\OpenOffice.org2
2008-04-14 13:09 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-04-12 19:18 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-03-21 20:30 120,056 ------w C:\WINDOWS\system32\PxCpyI64.exe
2008-03-21 20:30 118,520 ------w C:\WINDOWS\system32\PxInsI64.exe
2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2007-02-06 23:42 1,398,352 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
2007-02-02 04:52 80 --sh--r C:\WINDOWS\system32\870D8849F9.dll
2007-10-28 22:36 168 --sh--r C:\WINDOWS\system32\F949880D87.sys
.

((((((((((((((((((((((((((((( snapshot@2008-06-11_16.14.17.12 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 01:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 11:03 868352]
"DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-06-05 10:48 2113360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 01:00 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-11 15:35:31 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2006-08-07 13:40:32 262144]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\FrostWire\\FrostWire.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 14:47]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 19:20]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-07-06 17:06]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 19:16]
R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-06-01 12:41]
R3 SecureSrv;SecureSrv;C:\Program Files\Hide My IP 2007\SecureSrv.exe [2007-12-18 11:22]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 01:00]
S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\YH-925.sys [2004-06-24 13:52]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-12 11:42:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-11 20:55:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{4E30322B-F709-43A0-9587-596D13591BCF}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 16:55:42
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\securenet.dll
.
Temps d'accomplissement: 2008-06-11 16:56:19
ComboFix-quarantined-files.txt 2008-06-11 20:56:09
ComboFix2.txt 2008-06-11 20:14:34

Pre-Run: 47,615,229,952 octets libres
Post-Run: 47,604,932,608 octets libres

224 --- E O F --- 2008-06-06 04:49:17

+

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:02:16, on 2008-06-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Hide My IP 2007\SecureSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Admin\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {2fb5b67a-05e1-4cb5-997d-55f1ef650fe6} - (no file)
O2 - BHO: (no name) - {3CC068A5-8E60-4D5A-99EC-44A60E7CBD13} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7F7DAAD8-D1A0-46C3-8134-7FAAE453D4A4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A0B4FFEA-D466-49A8-9BB0-B7BBD2FCB449} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/piczo_fast_uploader.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} (SpiderSolitaire Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - https://www.worldwinner.com/frontend_404.shtml
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.xfinity.com
O20 - Winlogon Notify: yayvWqnl - C:\WINDOWS\
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file)
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SecureSrv - Unknown owner - C:\Program Files\Hide My IP 2007\SecureSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Utilisateur anonyme · Answer

Réouvre hijackthis
fais scan only
coche ces lignes :

O2 - BHO: (no name) - {2fb5b67a-05e1-4cb5-997d-55f1ef650fe6} - (no file) 
O2 - BHO: (no name) - {3CC068A5-8E60-4D5A-99EC-44A60E7CBD13} - (no file) 

O2 - BHO: (no name) - {7F7DAAD8-D1A0-46C3-8134-7FAAE453D4A4} - (no file) 


O2 - BHO: (no name) - {A0B4FFEA-D466-49A8-9BB0-B7BBD2FCB449} - (no file) 


O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab 
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/piczo_fast_uploader.cab 
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - https://www.worldwinner.com/frontend_404.shtml 
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} (SpiderSolitaire Control) - https://www.worldwinner.com/frontend_404.shtml 
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/frontend_404.shtml 
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab 
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - https://www.worldwinner.com/frontend_404.shtml 
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.xfinity.com 
O20 - Winlogon Notify: yayvWqnl - C:\WINDOWS\ 
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file) 


tu les coches et tu clic sur fix checked

ensuite désinstal java car pas a jours et telecharge et instal cette version :

https://www.java.com/fr/download/manual.jsp

ensuite dis moi comment va le pc stp

Anthonyz · Answer

Eh ben Merci pour pour l'aide !!

Plus de problème tout est parfait!

Merci Beaucoup!

Utilisateur anonyme · Answer

DE rien :

fais ça :

* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe 
http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe 

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Anthonyz · Answer

-->- Recherche: 

C:\Qoobox: trouvé !
C:\Documents and Settings\Admin\Bureau\Clean.zip: trouvé !
C:\Documents and Settings\Admin\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\Admin\Bureau\clean	ar.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\cleanemove.reg: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\pskill.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\LFiles.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\gzip.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\delsiri.cmd: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\delr.cmd: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\del3.cmd: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\del2.cmd: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\clean.cmd: trouvé !
C:\Documents and Settings\Admin\Bureau\clean\cherche.cmd: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\Admin\Bureau\Clean.zip: supprimé !
C:\Documents and Settings\Admin\Bureau\ComboFix.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\clean	ar.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\cleanemove.reg: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\pskill.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\LFiles.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\gzip.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\delsiri.cmd: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\delr.cmd: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\del3.cmd: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\del2.cmd: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\clean.cmd: supprimé !
C:\Documents and Settings\Admin\Bureau\clean\cherche.cmd: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\Admin\Bureau\SmitFraudfix: supprimé !

Utilisateur anonyme · Answer

Voila c est propre !!

si tu n as pas d autres soucis change le statut du sujet en resolu stp

Anthonyz · Answer

j'ai un petit soucis le petit icone d'avast antivirus n'apparait plus à coté de l'heure.

est-ce à cause des nettoyages qu'on a fait ou il y a un moyen de le faire réapparaitre?

Utilisateur anonyme · Answer

certanement du a combofix 

mais je l avais oublié ce avast :

regarde ceci concernant avast : 

antivir vs avast : 

-> http://forum.malekal.com/ftopic3528.php 

alors je te conseille de le desinstaller et d´installer antivir a la place 

Telecharge et instales l'antivirus Antivir Personal Edition Classic : 

->https://www.malekal.com/avira-free-security-antivirus-gratuit/ 

https://www.avira.com/en/prime 

http://mickael.barroux.free.fr/securite/antivir.php 
http://speedweb1.free.fr/frames2.php?page=tuto5 

Pour désinstaller Avast telecharge cet outil

https://www.avast.com/fr-fr/uninstall-utility


et aussi :


pare-feu gratuits 


télécharger la version gratuite de Zone alarm 
https://www.pcastuces.com/logitheque/zonealarm.htm 
TUTO 
http://securite-facile.ovh.org/zonealarm.php 
http://forum.telecharger.01net.com/forum/ 
désactivé les parties filtrage web et antivirus de ZA ! C'est important 

ou 

télécharger la version gratuite de Kerio 
Kerio (parefeu) 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html 
TUTO 
https://kerio.probb.fr/ 
SITE de Kerio 
https://kerio.probb.fr/ 

ou 

ComodoFirewallPro 2.4 téléchargement 
http://www.personalfirewall.comodo.com/ 
Tuto pour la 2.4 
https://infomars.fr/forum/index.php?s=908072e48ff7cf0359366440cb26c93f&showtopic=389 
Tuto pour la 2.4 
http://www.nordicnature.net/tutorials/comodo/cf24wiz.htm 
Attention la 3.0 est en anglais uniquement et est plus difficile a paramétrer 
Tuto pour la 3.0 
https://infomars.fr/forum/index.php?showtopic=1225

Anthonyz · Answer

OK MERCI POUR TOUT!

RÉSOLU!!

Utilisateur anonyme · Answer

de rein ciao et bon surf

Ythyl · Answer

merci beaucoup pour votre patience. J'avais exactement le même soucis que mon prédécesseur, mais moins infecté cependant. J'ai suivi pas à pas les posts, et avec les bons programmes ainsi que mes connaissances en info, j'ai réussi à tuer le virus. :)

kirlian51 · Answer

Bonjour,
hier soir j'ai chopé ce virus et depuis je cherche des solutions!
Y a t-il quelqu'un en ligne pour m'aider!
Le virus de me laisse rien faire, il bloque tout les détecteurs de virus!

Panique à bord!!
Merci de votre aide

touman · Answer

Je m'insurge encore contre toutes ces explications tres floues et souvent incomprehensibles.
Il y a tres simple quand vous avez "Warning:secruity report.Your computor is infected....etc" 
J'ai été infectée ce matin.Ecran noir et tout et tout.La totale.
J'ai simplement téléchargé Trajan Remover
https://www.cnetfrance.fr/telecharger/trojan-remover-11008989s.htm
Et tout est rentré dans l'ordre.
Aucune manip a faire.
J'espere que cela aidera le prochain qui sera infecté.

Warning! Security report

34 réponses

Discussions similaires

Newsletters