Sujet Précédent Sujet Suivant

INFECTION PC

Résolu/Fermé
stephanie24290 Messages postés 6 Date d'inscription jeudi 1 mai 2008 Statut Membre Dernière intervention 1 mai 2008 - 1 mai 2008 à 17:50
manu_dog Messages postés 505 Date d'inscription mercredi 21 novembre 2007 Statut Membre Dernière intervention 11 juin 2011 - 1 mai 2008 à 22:50
Bonjour,
Depuis peu mon PC est infecté par error cleaner, privacy protection et spyware malware.
Je suis sous windows xp et j'utilise IE.
Merci de m'apporter votre aide car je suis trés peu douée en informatique.
A voir également:

3 réponses

Réponse 1 / 3
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
1 mai 2008 à 17:51
slt,


smit fraud fix (colle le rapport)

1/ telecharger :

http://siri.urz.free.fr/Fix/SmitfraudFix.php


2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes.

attends pour la suite

3/ redémarre en mode sans échec (en appuyant sur F8 ou suppr, ou F5 au démarrage en général) puis lance smitfraudfix , sélectionne l'option 2 et appuyer sur entrée pour commencer la désinfection. lorsque le programme demande si tu veut nettoyer le registre mets oui en tapant 0 et entrée


________________



colle un rapport hijackthis


http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :
http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."
1
Réponse 2 / 3
dou-l Messages postés 2860 Date d'inscription vendredi 29 février 2008 Statut Membre Dernière intervention 29 décembre 2012 61
1 mai 2008 à 17:51
slt


télécharge smitfraudfix: smitfraudfix

# Double clique sur l'icone de smitfraud pui choisis l'option 1 et poste le rapport.

Tient moi au courant a+.
1
Réponse 3 / 3
manu_dog Messages postés 505 Date d'inscription mercredi 21 novembre 2007 Statut Membre Dernière intervention 11 juin 2011 41
1 mai 2008 à 17:51
Commence par ceci

Télécharge BTFix 1.017 (de bibi26)
BTFix vous propose de détecter et de désinstaller les barres d'outils publicitaires, qui s'invitent souvent lors de l'installation d'applications. Ce programme vous permet d'éliminer facilement les toolbars indésirables telles que Zango, MyWebSearch, MySearch, WhenU, Spam Blocker Utility, EZshopper, Browser Accelerator et beaucoup d'autres.

http://cluster1.easy-hebergement.net/

RECHERCHE
* Décompresse l'archive sur ton Bureau (Clique-Droit/Extraire tout).
* Ouvre le dossier "BTFix"
* Double clique sur "BTFix.exe"
* Clique sur "Rechercher"
* Un rapport va apparaître, copie/colle-le dans ta prochaine réponse
NETTOYAGE
* Démarre l'ordinateur en MSE comme ceci http://www.coupdepoucepc.com/modules/news/article.php?storyid=253 > ==> (Une fois le chargement du BIOS terminé, il y a un écran noir. Appuie sur la touche F8 ou F5, à répétition jusqu'à l'affichage du menu des options avancées de Windows. Ensuite, en utilisant les touches du curseur, sélectionne "mode sans échec" et appuie sur [Entrée]. Choisis ton compte usuel et non pas "Administrateur".)
* Ouvre "BTFix"
* Clique sur "Nettoyer" * Un rapport va apparaître, copie/colle-le dans ta prochaine réponse



Poursuis avec cette analyse, STP:

Télécharge et installe Malwarebyte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Suivre ce tutoriel https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm

A la fin du scan >>> clique sur « Afficher les résultats » >>> « Enregistrer le Rapport »
Suppression des éléments détectés >>>> clique sur « Supprimer la sélection »
S'il t'est demandé de redémarrer >>> clique sur "Yes"

Un rapport de scan s'ouvre, poste le rapport.




Merci
0
stephanie24290 Messages postés 6 Date d'inscription jeudi 1 mai 2008 Statut Membre Dernière intervention 1 mai 2008
1 mai 2008 à 18:19
bonjour manu dog
j'ai fais ce que tu m a demandé avec BTFIX
Voici le rapport
BTFix 1.098 (par bibi26) - 01/05/2008 18:16:01 - Analyse
Lancé depuis C:\Documents and Settings\NEIRYNCK STEPHANIE\Bureau\BTFix\BTFix.exe

---> Fichiers/Dossiers trouvés


---> Analyse terminée le 01/05/2008 18:16:02
0
manu_dog Messages postés 505 Date d'inscription mercredi 21 novembre 2007 Statut Membre Dernière intervention 11 juin 2011 41 > stephanie24290 Messages postés 6 Date d'inscription jeudi 1 mai 2008 Statut Membre Dernière intervention 1 mai 2008
1 mai 2008 à 18:20
il faut le deuxième rapport également
0
stephanie24290 Messages postés 6 Date d'inscription jeudi 1 mai 2008 Statut Membre Dernière intervention 1 mai 2008 > manu_dog Messages postés 505 Date d'inscription mercredi 21 novembre 2007 Statut Membre Dernière intervention 11 juin 2011
1 mai 2008 à 18:41
je te joins l'autre rapport
BTFix 1.098 (par bibi26) - 01/05/2008 18:37:03 - Nettoyage - Mode sans échec
Lancé depuis C:\Documents and Settings\NEIRYNCK STEPHANIE\Bureau\BTFix\BTFix.exe

---> Fichiers/dossiers supprimés (Première passe)

- Fichiers temporaires effacés

---> Nettoyage terminé le 01/05/2008 18:37:07
0
stephanie24290 Messages postés 6 Date d'inscription jeudi 1 mai 2008 Statut Membre Dernière intervention 1 mai 2008 > manu_dog Messages postés 505 Date d'inscription mercredi 21 novembre 2007 Statut Membre Dernière intervention 11 juin 2011
1 mai 2008 à 19:30
voici la suite
Malwarebytes' Anti-Malware 1.11
Version de la base de données: 707

Type de recherche: Examen complet (C:\|)
Eléments examinés: 93391
Temps écoulé: 32 minute(s), 22 second(s)

Processus mémoire infecté(s): 4
Module(s) mémoire infecté(s): 8
Clé(s) du Registre infectée(s): 85
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 13
Fichier(s) infecté(s): 137

Processus mémoire infecté(s):
C:\WINDOWS\system32\wlgjmlyv.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\Documents and Settings\All Users\Application Data\ghirohad\uhgdspyv.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\WINDOWS\system32\wlgjmlyv.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\Program Files\XP Antivirus\xpa.exe (Rogue.XPAntivirus) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\WINDOWS\system32\ddcCSmJd.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\dqposkfw.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\ssqRLFuu.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\cbXRJDSL.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\dsktbwfe.dll (Trojan.FakeAlert) -> Unloaded module successfully.
C:\WINDOWS\nslbvxpgtkn.dll (Trojan.FakeAlert) -> Unloaded module successfully.
C:\WINDOWS\ogxtsepr.dll (Trojan.FakeAlert) -> Unloaded module successfully.
C:\WINDOWS\sgoblxtm.dll (Trojan.FakeAlert) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{eec73ea5-1367-49d1-93f4-ca1d8c22e9f9} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eec73ea5-1367-49d1-93f4-ca1d8c22e9f9} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{410a64d5-fd64-4ec6-af9a-dd46d7e9a8c0} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{410a64d5-fd64-4ec6-af9a-dd46d7e9a8c0} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{e4d71e45-94e1-a19a-a939-b7d2a756f719} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7d4c17e6-b0d7-4de2-a128-67f2fa1d4ff6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cba0a72a-c5b0-47f8-9bd7-307b7708a58d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0882b175-f982-41b1-91a6-3593ab992df7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4708135c-9d19-4b8a-a47c-7f85ec67b5ee} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{17d4667e-4c4b-4f45-a22b-4087f9e1ff00} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{28621188-61c7-4829-a54b-3b73d055e982} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3544568d-d586-4746-84b9-84c7706ad597} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4f2a5211-53b6-4c07-9a6d-959bf989528f} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{535841d3-f4e1-4d3a-b506-cbc7f4e14913} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{58035c9e-9a00-42fe-8f38-b380704f8eba} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5c6d3658-833b-4e33-8bf4-77c4173770cf} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6d1595ce-b92a-47c5-9cc3-ae11e5a9aafa} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{83481be4-117a-4bb4-87b1-2b14528b64a7} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{878bf64d-da3b-417c-a957-19662d5331c3} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8a5b98b5-6cc9-49d4-967c-bb6aaa04e7e4} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8c55cf0f-fd4a-4b03-9365-906b0bfa86cc} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b216377d-994c-4555-b44f-35f64d586833} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c2105722-4ecc-48e8-866a-bf166ca967c4} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c4585709-b01d-4ee5-9274-3e34ea56e4b8} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cccc68a6-7114-423a-b9a5-7110eb925edd} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e04407f5-f6b9-495d-a767-4d860e42dbe2} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{5a4c66fb-4b04-478c-b855-fca385797db7} (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc-cleaner (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3e186502-0c2a-4439-ba8d-b76dcbdb0f92} (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\uninstall (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\services (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Classes\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\PC-Cleaner (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\PC-Cleaner (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Gln.GLNBho (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b4c0c60c-1eff-4ac4-8f17-8d616c94cdfd} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b4c0c60c-1eff-4ac4-8f17-8d616c94cdfd} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbxrjdsl (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3661dd57-c61c-4709-ac3b-eab61f916095} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{97ebe3cc-10a7-4619-b127-9b5d4fa476a8} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97ebe3cc-10a7-4619-b127-9b5d4fa476a8} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b5ea903e-9cc2-41e8-9e2b-8c5457f36e3b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{57aba3ce-e927-4c81-be2e-e20caec6645f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sgoblxtm.bpsb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sgoblxtm.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MSVPS.MSVPSApp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SystemDefender (Rogue.SystemDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\gln.glnbho.1 (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{eec73ea5-1367-49d1-93f4-ca1d8c22e9f9} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sargcskk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LvpennzCjD (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c17f18b (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e©ùýùàûïÒóÎÑøøËøôÖÊýòñûöÞó (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PC-Cleaner (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3e186502-0c2a-4439-ba8d-b76dcbdb0f92} (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{b4c0c60c-1eff-4ac4-8f17-8d616c94cdfd} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\dsktbwfe (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ogxtsepr (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{57aba3ce-e927-4c81-be2e-e20caec6645f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ssqrlfuu -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ssqrlfuu -> Delete on reboot.

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\SalesMonitor (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SalesMonitor\Data (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Program Files\akl (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\XP Antivirus (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\com (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\install (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\WINDOWS\system32smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Application Data\PC-Cleaner (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\WINDOWS\system32\ddcCSmJd.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcYrRhe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ehRrYcdd.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ehRrYcdd.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dqposkfw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wfksopqd.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssqRLFuu.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\uuFLRqss.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uuFLRqss.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wlgjmlyv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\ghirohad\uhgdspyv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Local Settings\Temporary Internet Files\Content.IE5\F75EUCK9\zrt20080408[1] (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Local Settings\Temporary Internet Files\Content.IE5\Q3PBMA69\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Local Settings\Temporary Internet Files\Content.IE5\WBMVOO75\AtnvrsInstall[1].exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP94\A0008752.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP97\A0010059.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP97\A0010073.exe (Rogue.SystemDefender) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP97\A0011104.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP98\A0014267.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP99\A0015343.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP99\A0016374.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\VundoFix Backups\ddcCSmJd.dll.bad (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\llgqvrmk.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ogjvuiii.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\WINDOWS\Web\def.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Program Files\akl\akl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\akl\akl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\akl\uninstall.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\akl\unsetup.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\XP Antivirus\xpa.exe (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\XP Antivirus\xpa.exe.tmp (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\extensions.bak (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\PC-Cleaner.db (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\PC-Cleaner.exe (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\pccleaner.pkg (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\program.info (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\Uninstall.exe (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\Uninstall.exe.bak (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\com\pcsd.dll (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Program Files\PC-Cleaner\install\PC-Cleaner.exe (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\WINDOWS\system32smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Application Data\PC-Cleaner\log.dat (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Application Data\PC-Cleaner\settings.dat (Rogue.PC-Cleaner) -> Quarantined and deleted successfully.
C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32akttzn.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32anticipator.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32awtoolb.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32bdn.com (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32bsva-egihsg52.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32dpcproxy.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32emesx.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32h@tkeysh@@k.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32hoproxy.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32hxiwlgpm.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32hxiwlgpm.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32medup012.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32medup020.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32msgp.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32msnbho.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32mssecu.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32msvchost.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32mtr2.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32mwin32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32netode.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32newsd32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32ps1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32psof1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32psoft1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32regc64.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32regm64.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32Rundl1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32sncntr.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32ssurf022.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32ssvchost.com (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32ssvchost.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32sysreq.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32taack.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32taack.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32temp#01.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32thun.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32thun32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32VBIEWER.OCX (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32vbsys2.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32vcatchpi.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32winlogonpc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\System32WINWGPX.EXE (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\rs.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cbXRJDSL.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcCvsPh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRLbxUK.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifcBqpq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iiffFuTJ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyxvuss.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\dsktbwfe.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\nslbvxpgtkn.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\ogxtsepr.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\sgoblxtm.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\spnkfwad.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\.protected (Rogue.Ultimate.Defender) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\etc\.protected (Rogue.Ultimate.Defender) -> Quarantined and deleted successfully.
C:\.protected (Rogue.Ultimate.Defender) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Application Data\Microsoft\Internet Explorer\Quick Launch\XP Antivirus 2008.lnk (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareCrush 3.7.lnk (Rogue.MalwareCrush) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Bureau\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Bureau\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Bureau\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Bureau\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Bureau\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Bureau\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK STEPHANIE\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\NEIRYNCK CSV\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
0
stephanie24290 Messages postés 6 Date d'inscription jeudi 1 mai 2008 Statut Membre Dernière intervention 1 mai 2008 > manu_dog Messages postés 505 Date d'inscription mercredi 21 novembre 2007 Statut Membre Dernière intervention 11 juin 2011
1 mai 2008 à 19:53
grand merci!!!!!!!!!!! manu dog
Tout est redevenu normal
bonne soirée
stéphanie
0