AIDEZ MOI SVP ! Hadopi est ds mon PC ! !

bonjour

sa sen l'arnaque


Téléchargez MalwareByte's Anti-Malware

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet (examen assez long)
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. Rends toi dans l'onglet rapport/log
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller


Si tu as besoin d'aide regarde ces tutoriels :
Aide: http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php
http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

bonsoir :

cctrl + alt + supp

termine le processus : Apmanager

ensuite onglet fichier , tape : explorer et valide

ensuite tu peux utiliser les outils une fois le bureau reapparu

dans le gestionnaire des taches , en haut à gauche , onglet fichier

selectionne nouvelle tache , tape : Explorer et valide

ok on va faire autrement :

demarrer/executer , puis tapes regedit et valide

deplie tout ce qui suit et rejoins cette clé :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

clique sur Run et colonne de droite clique droit sur : ApManager.exe et supprime , ensuite redemarre ton pc

si MBAM tourne c'est bon

ok à lire le rapport...

pas mal !!^^

Voilà le rapport, acec au moins une trentaine de fichiers infectés ! :


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

30/04/2010 09:39:04
mbam-log-2010-04-30 (09-39-04).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|M:\|)
Elément(s) analysé(s): 245054
Temps écoulé: 1 heure(s), 35 minute(s), 0 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 9
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 20

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\armanager (Trojan.FraudTool) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell (Rogue.APManager) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsdefrag (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\secfile\shell\open\command\(default) (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\VVSN (Adware.WhenU) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\HP_Propriétaire\Application Data\ARManager\uninstall.exe (Trojan.FraudTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\xsocamnwer.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\gmfrxpgv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\stpec7af.exe (Trojan.FraudTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\nesxmcowar.tmp (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\012345OP\stp4e89e[1].exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\012345OP\rvqxfn[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\4LQJ0LMF\hypwhc[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\4LQJ0LMF\stpd32fb[1].exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\OXAB81E3\stpec7af[1].exe (Trojan.FraudTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089758.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089759.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089760.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089761.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089762.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089763.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089764.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0089765.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP464\A0093765.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\oxemwracns.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

bonjour :

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

▶ Télécharge List_Kill'em et enregistre le sur ton bureau

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

Laisse coché :

♦ Executer Shortcut
♦ Executer List_Kill'em

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

Mais si je désactive ANTIVIR], je na serai plus protégé ? Comment savoir si j'ai un parefeu ?

toute facon si tu es infecté l'antivirus ne te sert a rien vu qu il ne te dit rien

Ok donc après il faudra trouver un anivirus qui fonctionne...

http://www.commentcamarche.net/...

ok!

J'arrive pas à le poster. Au dessus de l'encart, on me demande d'activer javascript

Et pourquoi, on me dit d'activer java script alors que c'est activé ! ! !

Maintenant, une fenêtre vient d'apparaître :


Warning! Your computer is at risk of malware attacks.



We recommend you to check your system immediately. Press OK to start the process now

Puis ça veut me faire télécharger une application...

le rapport n'est pas complet

ok la suite :

Present !! : C:\Documents and Settings\HP_Propri'taire\Application Data\Search Settings
Present !! : C:\Documents and Settings\HP_Propri'taire\Bureau\ARManager.lnk
Present !! : C:\Documents and Settings\HP_Propri'taire\Local Settings\Temp\afl.log
Present !! : C:\Documents and Settings\HP_Propri'taire\Local Settings\Temp\url.txt
Present !! : C:\Documents and Settings\HP_Propri'taire\Local Settings\Temp\WAY.gif
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\apatch.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\AskInstallChecker.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\DWPUpgradeInstaller.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Free-YouTube-to-MP3-Converter.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpzmsi01.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpzscr01.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\IE8-Setup-Full-XP.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Install.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\pylA4.tmp.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\setup_wm.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\utt295.tmp.exe
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpqscr01.dat
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpzscr01.exe.dat
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Perflib_Perfdata_3f0.dat
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Perflib_Perfdata_7d4.dat
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\gtapi.dll
Present !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\msvbvm60.dll

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings
Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
Present !! : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{00000000-6E41-4FD3-8538-502F5495E5FC}
Present !! : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Present !! : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"
Present !! : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"
Present !! : "HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
Present !! : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"
Present !! : "HKLM\Software\Search Settings"
Present !! : HKCR\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}
Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Present !! : HKCR\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}
Present !! : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKCR\GenericAskToolbar.ToolbarWnd
Present !! : HKCR\GenericAskToolbar.ToolbarWnd.1
Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\SearchSettings.BHO
Present !! : HKCR\SearchSettings.BHO.1
Present !! : HKCR\secfile
Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Present !! : HKCU\Software\AppDataLow\AskBarDis
Present !! : HKCU\software\appdatalow\AskHomepage
Present !! : HKCU\software\appdatalow\AskToolbarInfo
Present !! : HKCU\Software\AppDataLow\Software\Dealio
Present !! : HKCU\software\Ask.com
Present !! : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Present !! : HKLM\software\classes\appid\GenericAskToolbar.DLL
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Present !! : HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Present !! : HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd
Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
Present !! : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Present !! : HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Present !! : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Present !! : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Present !! : HKLM\Software\Classes\SearchSettings.BHO
Present !! : HKLM\Software\Classes\SearchSettings.BHO.1
Present !! : HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Present !! : HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
Present !! : HKLM\Software\Dealio
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Present !! : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-30 12:20:59
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe >>UNKNOWN [0x8619BBF8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0x8619bbf8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 12:21:02,51

▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'Option Clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

▶ colle le contenu dans ta reponse

Voilà le contenu du fichier kill'em.txt :

Kill'em by g3n-h@ckm@n 1.7.2.5

User : HP_Propriétaire (Administrateurs)
Update on 29/04/2010 by g3n-h@ckm@n ::::: 21.00
Start at: 17:31:55 | 30/04/2010

AMD Turion(tm) 64 Mobile Technology ML-34
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]
AV : avast! antivirus 4.8.1169 [VPS 080329-0] 4.8.1169 [ (!) Disabled | (!) Outdated ]

C:\ -> Disque fixe local | 273,29 Go (11,28 Go free) [HP_PAVILION] | NTFS
D:\ -> Disque fixe local | 6,15 Go (634,18 Mo free) [HP_RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible | 1,86 Go (257,15 Mo free) [CLÉ USB] | FAT32
M:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Program Files\Ask.com
Quarantined & Deleted !! : C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js
Quarantined & Deleted !! : C:\Program Files\Mozilla FireFox\Components\AskSearch.js
Quarantined & Deleted !! : C:\Program Files\Mozilla FireFox\extensions\searchsettings@spigot.com
Quarantined & Deleted !! : C:\Program Files\Search Settings
Quarantined & Deleted !! : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Quarantined & Deleted !! : C:\WINDOWS\struct~.ini

Quarantined & Deleted !! : C:\WINDOWS\System32\_psisdecd.dll
Quarantined & Deleted !! : C:\WINDOWS\system32\MSWINSCK.OCX
Quarantined & Deleted !! : C:\WINDOWS\Temp\is107.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is109.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEP6.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\Application Data\waver_2.95.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\Application Data\Dealio
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\Application Data\Search Settings
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\Bureau\ARManager.lnk
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\Local Settings\Temp\afl.log
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\Local Settings\Temp\url.txt
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\Local Settings\Temp\WAY.gif
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\apatch.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\AskInstallChecker.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\DWPUpgradeInstaller.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Free-YouTube-to-MP3-Converter.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpzmsi01.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpzscr01.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\IE8-Setup-Full-XP.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Install.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\pylA4.tmp.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\setup_wm.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\utt295.tmp.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpqscr01.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\hpzscr01.exe.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Perflib_Perfdata_3f0.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\Perflib_Perfdata_7d4.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\gtapi.dll
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri'taire\LOCAL Settings\Temp\msvbvm60.dll

=======
Hosts :
=======

127.0.0.1 localhost

========
Registry
========

Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings
Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{00000000-6E41-4FD3-8538-502F5495E5FC}
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Deleted : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Deleted : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"
Deleted : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"
Deleted : "HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}"
Deleted : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"
Deleted : "HKLM\Software\Search Settings"
Deleted : HKCR\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}
Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Deleted : HKCR\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}
Deleted : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Deleted : HKCR\GenericAskToolbar.ToolbarWnd
Deleted : HKCR\GenericAskToolbar.ToolbarWnd.1
Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\SearchSettings.BHO
Deleted : HKCR\SearchSettings.BHO.1
Deleted : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Deleted : HKCU\Software\AppDataLow\AskBarDis
Deleted : HKCU\software\appdatalow\AskHomepage
Deleted : HKCU\software\appdatalow\AskToolbarInfo
Deleted : HKCU\Software\AppDataLow\Software\Dealio
Deleted : HKCU\software\Ask.com
Deleted : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Deleted : HKLM\software\classes\appid\GenericAskToolbar.DLL
Deleted : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Deleted : HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Deleted : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Deleted : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Deleted : HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
Deleted : HKLM\Software\Dealio
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Deleted : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://go.microsoft.com/fwlink/?LinkId=69157
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ http://go.microsoft.com/fwlink/?LinkId=54896
Default_Page_URL REG_SZ http://go.microsoft.com/fwlink/?LinkId=69157
Search Page REG_SZ http://go.microsoft.com/fwlink/?LinkId=54896

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.google.com/
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)

========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤