Popup intempestifs
Forum Sécurité - Virus : Popup intempestifs
Slt a tous
Pourriez vous m'aider a lire ce rapport hijack pour supprimer mes popup intempestifs
Je vous remercies par avance et bravo pour l'entraide sur ce forum
Agnès
Logfile of HijackThis v1.99.1
Scan saved at 00:21:50, on 11/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\PROGRA~1\Wanadoo\taskbaricon.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spy Shot\Capture.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\lxbtcoms.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: phoneaccess Class - {5054F860-748D-4840-B7B4-DDDB428421AF} - C:\WINDOWS\DOWNLO~1\PHONEA~1.DLL (file missing)
O2 - BHO: SponsorAdulto Class - {511F9316-771B-4953-A268-1C36DA667FE9} - C:\WINDOWS\Downloaded Program Files\sponsoradulto.dll (file missing)
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\taskbaricon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe /iconic
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [Smod] C:\Program Files\Spy Shot\Capture.exe
O4 - HKCU\..\Run: [AXVenore] "C:\Program Files\AXVenore\AXVenore.exe"
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Search - http://kt.bar.need2find.com/KT/menusearch.html?p=KT
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Interface Chat Wanadoo - http://chat14.x-echo.com/version6/Applet/wchatsign.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.c [...] 1/chat.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.c [...] acscom.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/ac [...] 0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5054F860-748D-4840-B7B4-DDDB428421AF} (phoneaccess Class) - http://ip.sponsoradulto.com/cab/4/fr/phoneaccess.cab
O16 - DPF: {511F9316-771B-4953-A268-1C36DA667FE9} (SponsorAdulto Class) - http://ip.sponsoradulto.com/cab/3/ [...] comInt.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/micros [...] 1247698703
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/hardwaredetection.cab
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmaw [...] Player.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.oziol-motos.com/axis/AxisCamControl.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - AppInit_DLLs: Runner.dll,SDRunner.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxbtcoms.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
Bonsoir,
Télécharge F-Secure Blacklight : https://europe.f-secure.com/blacklight/try.shtml
- Clic en bas sur "I accept"
- Dans la nouvelle fenêtre, clic sur le bouton en haut du tableau Download.
- Lance-le en double-cliquant sur le fichier blbeta.exe
- Accepte la licence, et clique enfin sur "Scan"
- Poste le rapport qui a été créé dans le fichier fsbl-bxxxx.log en l'ouvrant avec le bloc-note.
Tu peux consulter le tutorial de F-Secure BlackLight
Bonsoir et merci pour le coup de main.Voila le resultat du scan
A bientot
08/11/06 03:05:06 [Info]: BlackLight Engine 1.0.42 initialized
08/11/06 03:05:06 [Info]: OS: 5.1 build 2600 (Service Pack 2)
08/11/06 03:05:06 [Note]: 7019 4
08/11/06 03:05:06 [Note]: 7005 0
08/11/06 03:05:08 [Note]: 7006 0
08/11/06 03:05:08 [Note]: 7011 1812
08/11/06 03:05:08 [Note]: 7026 0
08/11/06 03:05:08 [Note]: 7026 0
08/11/06 03:05:08 [Note]: 7024 3
08/11/06 03:05:08 [Info]: Hidden process: C:\windows\system32\blgezf.exe
08/11/06 03:05:08 [Note]: FSRAW library version 1.7.1019
08/11/06 03:07:34 [Info]: Hidden file: c:\WINDOWS\system32\blgezf.dat
08/11/06 03:07:34 [Note]: 10002 1
08/11/06 03:07:35 [Info]: Hidden file: C:\windows\system32\blgezf.exe
08/11/06 03:07:35 [Note]: 10002 1
08/11/06 03:07:35 [Info]: Hidden file: c:\WINDOWS\system32\blgezf_nav.dat
08/11/06 03:07:35 [Note]: 10002 1
08/11/06 03:07:35 [Info]: Hidden file: c:\WINDOWS\system32\blgezf_navps.dat
08/11/06 03:07:35 [Note]: 10002 1
08/11/06 03:07:49 [Info]: Hidden file: c:\WINDOWS\Prefetch\BLGEZF.EXE-38DC654E.pf
08/11/06 03:07:49 [Note]: 10002 1
Voici la manipulation à effectuer en entier
Merci de bien vouloir :
- Lire attentivement les instructions demandées et prendre son temps pour les effectuer convenablement, sinon la désinfection ne sera pas complète.
- Si certains éléments ne sont pas trouvés, merci de le signaler mais de poursuivre les manipulations jusqu'au bout.
- A l'issu de la procédure, merci de bien copier/coller TOUS les rapports demandés.
- N'hésitez pas à consulter les liens d'aides, ils sont là pour vous guider !
Télécharge [color=blue]Brute Force Uninstaller (de Merijn)[/color].
Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Pour cela :
-- Ouvre le poste de travail
-- Double-clic sur le disque C
-- Menu Fichier en haut puis Nouveau et nouveau dossier
-- Tapez BFU dans le nom du nouveau dossier
Décompresser le fichier téléchargé dans ce nouveau dossier (C:\BFU)
Ensuite :
[color=red]FAIS UN CLIC-DROIT ICI[/color] et choisis "Enregistrer la cible sous..." afin de télécharger [color=red]EGDACCESS.bfu (de Metallica)[/color]. Sauvegarde dans le dossier créé (C:\BFU). **Note : si tu utilises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".
Important : Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : EGDACCESS.bfu et BFU.exe.
- Télécharge et installe ewido
- Mets le à jour à partir du menu update en haut, n'hésite pas à consulter l'Aide ewido pour tout problème.
- Télécharge clean.zip, décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.
____
-- Redémarre en mode en mode sans échec, si tu sais pas comment on fait lis ceci
-- Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laisse la ouverte.
Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)
- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :
EGDACCESS.bfu
- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\EGDACCESS.bfu
Clique sur Execute et laisse-le faire son travail.
Attendre que Complete script execution apparaîsse et clique sur OK.
Clique Exit pour fermer le programme BFU.
-- Ouvre le poste de travail
-- Double clic sur le disque C
-- Double clic sur le dossier Windows
-- Double clic sur le dossier system32
-- Fais un clic droit sur le fichier blgezf.exe puis dans le menu déroulant clic sur supprimer
-- Fais un clic droit sur le fichier blgezf.dat puis dans le menu déroulant clic sur supprimer
-- Fais un clic droit sur le fichier blgezf_nav.dat puis dans le menu déroulant clic sur supprimer
-- Fais un clic droit sur le fichier blgezf_navps.dat puis dans le menu déroulant clic sur supprimer
-- Navigue dans les dossiers et supprime, si existant :
C:\Program Files\MaillSkinner
- Ouvre ewido et clic sur l'onglet [color=#3333FF]Settings[/color], pour [color=#3333FF]How to Act [/color]sélèctionne [color=#3333FF]Quarantine[/color].
Reviens a l'onglet [color=#3333FF]Scan[/color] cliques [color=#3333FF]Complete system Scan[/color].
Le scan démarre.
A la fin cliquer sur [color=#3333FF]Apply all actions[/color]
Puis sur [color=#3333FF]Save report [/color]et pour finir [color=#3333FF]Save report as[/color] enregistrer sur le Bureau.
N'hésite pas à consulter l'Aide ewido pour tout problème.
____
-- Redémarre en mode normal : Menu Démarrer / Arreter / Redémarre l'ordinateur
Attention : dans le cas où l'ordinateur redémarre en boucle en mode sans échec, faire la manipulation inverse en décochant l'option /SAFEBOOT à l'aide de msconfig : voir à nouveau cette page : cliquez-ici
-- Fais un scan en ligne avec Internet Explorer : Scan Kaspersky et colle le rapport ici. Si tu es perdu, tu peux suivre cette aide pour les scans en ligne
-- Copie/Colle ici les rapports :
- du scan Kaspersky
- ewido
- le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt
- Relance un scan sur BlackLight et copie/colle le rapport ici
Message édité par Malekal_morte le 11-08-2006 à 09:17:12
Bonsoir
Toute la 1ere partie se passe impecc , mais lorsque je passe ne mode sans echec et que j'ouvre le dossier clean je ne trouve pas " clean.cmd " .Je n'ai que clean ; del2 ; del 3 ; delr ; pskill et remove .
Comment cela se fait il ?
merci d'avance
double-clic sur clean.
Voila les rapports EWIDO et Kaspersky
wido anti-spyware - Scan Report
---------------------------------------------------------
+ Created at: 00:40:17 12/08/2006
+ Scan result:
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP400\A0471767.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP400\A0472767.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP400\A0473766.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP400\A0474765.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP400\A0475767.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP400\A0475779.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475789.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475808.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP452\A0543088.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP453\A0543105.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP453\A0543122.exe -> Adware.Bestofer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475807.EXE -> Adware.BetterInternet : Cleaned with backup (quarantined).
C:\Program Files\Fichiers communs\dnrfpper\dhlbcnapcj\tpflnflbj.exe -> Adware.Gator : Cleaned with backup (quarantined).
C:\Program Files\Fichiers communs\dnrfpper\ftdbeent\lffanejn.exe -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{5054F860-748D-4840-B7B4-DDDB428421AF} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5054F860-748D-4840-B7B4-DDDB428421AF} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5054F860-748D-4840-B7B4-DDDB428421AF} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-1549014249-2415585462-4272703983-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5054F860-748D-4840-B7B4-DDDB428421AF} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\HbTools -> Adware.HotBar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\HbTools\HbTools -> Adware.HotBar : Cleaned with backup (quarantined).
C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\New.net -> Adware.NewDotNet : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\New.net -> Adware.NewDotNet : Cleaned with backup (quarantined).
HKU\S-1-5-21-1549014249-2415585462-4272703983-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475856.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475791.exe -> Adware.RXBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475835.dll -> Adware.RXBar : Cleaned with backup (quarantined).
C:\Program Files\RXToolBar -> Adware.RXToolbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475836.dll -> Adware.RXToolbar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{59879FA4-4790-461c-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : Cleaned with backup (quarantined).
HKU\S-1-5-21-1549014249-2415585462-4272703983-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{59879FA4-4790-461C-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Application Data\Starware\Manager -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Application Data\Starware\Manager\ManagerOptions.xml -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Application Data\Starware\Manager\ManagerOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined).
HKU\S-1-5-21-1549014249-2415585462-4272703983-1005\Software\Starware -> Adware.Starware : Cleaned with backup (quarantined).
HKU\S-1-5-21-1549014249-2415585462-4272703983-1005\Software\Starware\OriginalSearchAssistant -> Adware.Starware : Cleaned with backup (quarantined).
HKU\S-1-5-21-1549014249-2415585462-4272703983-1005\Software\Starware\SearchAssistant -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\whInstall -> Adware.Webhancer : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1549014249-2415585462-4272703983-1005\Dc62.sys -> Backdoor.Genlot.DX : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP486\A0655816.ocx -> Downloader.IstBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475858.exe -> Downloader.PurityScan.cl : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@casinodelrio[1].txt -> TrackingCookie.Casinodelrio : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@www.casinodelrio[2].txt -> TrackingCookie.Casinodelrio : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@crbanner.casinopays[2].txt -> TrackingCookie.Casinopays : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@casinotropez[1].txt -> TrackingCookie.Casinotropez : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@www.casinotropez[2].txt -> TrackingCookie.Casinotropez : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@banner.clubdicecasino[1].txt -> TrackingCookie.Clubdicecasino : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@clubdicecasino[1].txt -> TrackingCookie.Clubdicecasino : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@e-2dj6wjmieidzilq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@estat[1].txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@as1.falkag[2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@ehg-bestbuy.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@banner.newyorkcasino[2].txt -> TrackingCookie.Newyorkcasino : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@stat.onestat[2].txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@data2.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@weborama[2].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
C:\Documents and Settings\chrisagnes\Cookies\chrisagnes@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475860.exe -> Trojan.Scapur.k : Cleaned with backup (quarantined).
::Report end
KASPERSKY
KASPERSKY ONLINE SCANNER REPORT
Saturday, August 12, 2006 1:15:59 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 12/08/2006
Kaspersky Anti-Virus database records: 214327
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
Scan Statistics:
Total number of scanned objects: 65683
Number of viruses found: 24
Number of infected objects: 83 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:33:21
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\chrisagnes\Bureau\clean\clean\pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k skipped
C:\Documents and Settings\chrisagnes\Bureau\clean.zip/clean/pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k skipped
C:\Documents and Settings\chrisagnes\Bureau\clean.zip ZIP: infected - 1 skipped
C:\Documents and Settings\chrisagnes\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\chrisagnes\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\chrisagnes\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\chrisagnes\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\chrisagnes\Local Settings\Historique\History.IE5\MSHist012006081220060813\index.dat Object is locked skipped
C:\Documents and Settings\chrisagnes\Local Settings\Temp\~DF3354.tmp Object is locked skipped
C:\Documents and Settings\chrisagnes\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\chrisagnes\Mes documents\METEO.exe/data0019/HbTools.mlp Infected: not-a-virus:AdWare.Win32.HotBar.bq skipped
C:\Documents and Settings\chrisagnes\Mes documents\METEO.exe/data0019 Infected: not-a-virus:AdWare.Win32.HotBar.bq skipped
C:\Documents and Settings\chrisagnes\Mes documents\METEO.exe NSIS: infected - 2 skipped
C:\Documents and Settings\chrisagnes\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\chrisagnes\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\chrisagnes\UserData\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Log.txt Object is locked skipped
C:\OEMCUST\TOOLS\WIN32\PSKILL.EXE Infected: not-a-virus:NetTool.Win32.PsKill skipped
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SPPolicy.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SPStart.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SPStop.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton AntiVirus\Quarantine\025452ED.exe Infected: Trojan-Downloader.Win32.PurityScan.co skipped
C:\Program Files\Norton AntiVirus\Quarantine\071A1D33.EXE Infected: not-a-virus:AdWare.Win32.Bestofer.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\071D4730.exe Infected: not-a-virus:AdWare.Win32.Bestofer.b skipped
C:\Program Files\Norton AntiVirus\Quarantine\1187436F.exe Infected: not-a-virus:AdWare.Win32.CASClient.f skipped
C:\Program Files\Norton AntiVirus\Quarantine\1F1275D5.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.o skipped
C:\Program Files\Norton AntiVirus\Quarantine\2574133B.tmp/your_details.doc .exe Infected: Email-Worm.Win32.NetSky.x skipped
C:\Program Files\Norton AntiVirus\Quarantine\2574133B.tmp ZIP: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\2574133B.tmp CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\283C310D.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\28BF1873.exe/data0002 Infected: not-a-virus:AdWare.Win32.Agent.e skipped
C:\Program Files\Norton AntiVirus\Quarantine\28BF1873.exe NSIS: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\28BF1873.exe CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\28FE2473.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.l skipped
C:\Program Files\Norton AntiVirus\Quarantine\29014E6F.DLL Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\Program Files\Norton AntiVirus\Quarantine\29890EBD.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\2D103BE0.tmp/your_details.scr Infected: Email-Worm.Win32.NetSky.x skipped
C:\Program Files\Norton AntiVirus\Quarantine\2D103BE0.tmp ZIP: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\2D103BE0.tmp CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E3A6285.tmp Infected: Email-Worm.Win32.NetSky.z skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E9E1C9A.cab/mySetp.exe Infected: not-a-virus:AdWare.Win32.MyWebSearch.o skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E9E1C9A.cab CAB: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E9E1C9A.cab CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E9E1C9A.dll Infected: not-a-virus:AdWare.Win32.404Search.l skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E9E1C9A.exe/stream Infected: not-a-virus:AdWare.Win32.404Search.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E9E1C9A.exe NSIS: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E9E1C9A.exe CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\2EA24697.EXE Infected: not-a-virus:AdWare.Win32.Bestofer.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\2EA57093.exe Infected: not-a-virus:AdWare.Win32.Bestofer.b skipped
C:\Program Files\Norton AntiVirus\Quarantine\2FF053B1.DLL Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\Program Files\Norton AntiVirus\Quarantine\2FF37DAD.EXE Infected: not-a-virus:AdWare.Win32.Bestofer.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\2FF727AA.dll Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\Program Files\Norton AntiVirus\Quarantine\2FF727AA.exe Infected: not-a-virus:AdWare.Win32.Bestofer.b skipped
C:\Program Files\Norton AntiVirus\Quarantine\32060895.exe Infected: P2P-Worm.Win32.VB.dw skipped
C:\Program Files\Norton AntiVirus\Quarantine\43680725.dll Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\Program Files\Norton AntiVirus\Quarantine\43680725.fr8 Infected: not-a-virus:AdWare.Win32.CASClient.f skipped
C:\Program Files\Norton AntiVirus\Quarantine\437F0F04.exe Infected: not-a-virus:AdWare.Win32.Bestofer.b skipped
C:\Program Files\Norton AntiVirus\Quarantine\451C1488.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.o skipped
C:\Program Files\Norton AntiVirus\Quarantine\45C44350.DLL Infected: Trojan.Win32.Dialer.oj skipped
C:\Program Files\Norton AntiVirus\Quarantine\466A62D2.tmp Infected: Email-Worm.Win32.NetSky.x skipped
C:\Program Files\Norton AntiVirus\Quarantine\496722B0.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.l skipped
C:\Program Files\Norton AntiVirus\Quarantine\496722B0.exe/stream Infected: not-a-virus:AdWare.Win32.404Search.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\496722B0.exe NSIS: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\496722B0.exe CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\4A3A19C0.htm Infected: Exploit.HTML.Mht skipped
C:\Program Files\Norton AntiVirus\Quarantine\4A4417B5.htm Infected: Exploit.JS.CVE-2005-1790.u skipped
C:\Program Files\Norton AntiVirus\Quarantine\4A4741B1.htm Infected: Exploit.JS.CVE-2005-1790.u skipped
C:\Program Files\Norton AntiVirus\Quarantine\4AD94573.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.CASClient.m skipped
C:\Program Files\Norton AntiVirus\Quarantine\4AD94573.exe/stream Infected: not-a-virus:AdWare.Win32.CASClient.m skipped
C:\Program Files\Norton AntiVirus\Quarantine\4AD94573.exe NSIS: infected - 2 skipped
C:\Program Files\Norton AntiVirus\Quarantine\4AD94573.exe CryptFF: infected - 2 skipped
C:\Program Files\Norton AntiVirus\Quarantine\5E275D3E.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\6BF7742D.DLL Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\Program Files\Norton AntiVirus\Quarantine\707F3F10.tmp/document.exe Infected: Email-Worm.Win32.NetSky.x skipped
C:\Program Files\Norton AntiVirus\Quarantine\707F3F10.tmp ZIP: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\707F3F10.tmp CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\79550D0B.htm Infected: Exploit.JS.CVE-2005-1790.u skipped
C:\Program Files\Norton AntiVirus\Quarantine\7D703B02.exe Infected: not-a-virus:AdWare.Win32.CASClient.m skipped
C:\Program Files\Norton AntiVirus\Quarantine\7D7464FE.dll Infected: not-a-virus:AdWare.Win32.Agent.e skipped
C:\Program Files\Norton AntiVirus\Quarantine\7DA45AC8.exe Infected: not-a-virus:AdWare.Win32.CASClient.m skipped
C:\Program Files\Norton AntiVirus\Quarantine\7DAB2EC1.dll Infected: not-a-virus:AdWare.Win32.Agent.e skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475854.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.l skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475855.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.o skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475865.DLL Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP401\A0475880.dll Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP453\A0543143.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.l skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP453\A0543144.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.o skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP453\A0543222.DLL Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP453\A0543238.dll Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP498\A0672383.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP498\A0672384.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP498\A0672385.exe Infected: not-a-virus:AdWare.Win32.Gator.a skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP498\A0672386.exe Infected: not-a-virus:AdWare.Win32.Gator.a skipped
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP498\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\RESTORE.INS/C
OEMCUST/TOOLS/WIN32/PSKILL.EXE Infected: not-a-virus:NetTool.Win32.PsKill skipped
C:\WINDOWS\RESTORE.INS ARJ: infected - 1 skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system\RESTORE.INS/C
OEMCUST/TOOLS/WIN32/PSKILL.EXE Infected: not-a-virus:NetTool.Win32.PsKill skipped
C:\WINDOWS\system\RESTORE.INS ARJ: infected - 1 skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
Est ce Ok a ton avis
Supprime ce fichier : C:\Documents and Settings\chrisagnes\Mes documents\METEO.exe
Merci de refaire un scan avec BlackLight et de coller le rapport.
J'ai supprimé Meteo.exe et fait un scna blacklight qui ne m'a rien trouvé.
Tout est ok ???
Salut
Yep
- Nettoye ton ordinateur avec CCleaner : http://www.malekal.com/tutorial_CCleaner.html
- Désactive puis réactive la restauration du système :
- Mode d'emploi Windows XP
Tu peux ensuite désinstaller tous les programmes que l'on a utilisé.
je t'invite à jeter un coup d'oeil à ces liens dans la mesure du possible, essaye de rapporter ton infection :
Comment se protéger des virus : - Tout ceci est résume sur cette page : Sécuriser son ordinateur et connaître les menaces
Rapporte ton infection pour faire condamner les auteurs - créer ton message pour faire avancer les choses sur Malware-Complaints, pour faire entendre notre voix, nous devons être le plus nombreux possibles, alors rapport ton infection :
- Voir les règles du forum
- Après t'être enregistré à l'aide du bouton en haut "register", tu as alors sous forme de liste un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), créé un message dans le sujet "Autres infections" conforme au règle du forum (age, ville, département etc..)
---> http://www.malwarecomplaints.info/viewforum.php?f=10
Il y a 1490 utilisateurs connus et inconnus. Pour voir la liste des connectés connus, cliquez ici.
