[Résolu] Security Sphere

[loukebin]

votre liens pour le téléchargement de ATF-cleaner ne marche pas il me dit "ID not found"

[Apollo]

Ah bon, ben tiens voilà le mien. Download ATF-Cleaner.exe from Sendspace.com - send big files the easy way

 

Clique sur clic here to star download...

 

Enregistre-le sur ton bureau puis fais ce que que j'ai expliqué + haut avec lui

 

@++

Modifié le 10 décembre 2011 par Apollo

[loukebin]

Mon fils part se coucher( il a une competition demain matin de bonne heure), on a lancé la recherche avec malwarebytes qui risque d'être relativement longue. je n'ose pas faire sans lui. Merci pour votre disponibilité. on vous donnera des nouvelles demain

merci encore

PS un élément infecté a déjà été trouvé ( je laisse tourner) Bonne fin de soirée

[Apollo]

Ok, à demain.

 

Bonne nuit.

 

@+++

[loukebin]

bonjour, voila le rapport de malarebytes :

 

 

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

 

Version de la base de données: 8349

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

 

09/12/2011 10:14:11

mbam-log-2011-12-09 (10-14-11).txt

 

Type d'examen: Examen complet (C:\|H:\|J:\|)

Elément(s) analysé(s): 440872

Temps écoulé: 1 heure(s), 0 minute(s), 0 seconde(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 2

Valeur(s) du Registre infectée(s): 10

Elément(s) de données du Registre infecté(s): 7

Dossier(s) infecté(s): 6

Fichier(s) infecté(s): 18

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\securentm (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ws2_32sik (Rootkit.Agent) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Value: scui.cpl -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Value: wscui.cpl -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> Value: braviax -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Value: RList -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_XMLLookup (Hijacker.XMLLookup) -> Value: bak_XMLLookup -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_Application (Hijacker.Application) -> Value: bak_Application -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_intl (Hijacker.intl) -> Value: bak_intl -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ms18_word (Trojan.Agent) -> Value: ms18_word -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32 (Trojan.Agent) -> Value: Regedit32 -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\XMLLookup (Hijacker.XMLLookup) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s'>http://www.helpmeopen.com/?n=app&l=%04x&ext=%s'>http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s'>http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\intl (Hijacker.intl) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

c:\documents and settings\all users.windows\application data\13597654 (Rogue.Multiple) -> Quarantined and deleted successfully.

c:\program files\homeantivirus2010 (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\program files\homeantivirus2010\data (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\program files\homeantivirus2010\microsoft.vc80.crt (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\menu démarrer\programmes\homeantivirus2010 (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

c:\documents and settings\all users.windows\application data\pd21712gpkjl21712\pd21712gpkjl21712.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\application data\Sun\Java\deployment\cache\6.0\27\5625335b-3c0b6fc4 (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\Bureau\rk_quarantine\pd21712gpkjl21712.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlph.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlxf.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\windows media components\Encoder\wmfdist.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\application data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\Bureau\homeantivirus2010.lnk (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\application data\microsoft\internet explorer\quick launch\homeantivirus2010.lnk (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\all users.windows\application data\13597654\13597654 (Rogue.Multiple) -> Quarantined and deleted successfully.

c:\documents and settings\all users.windows\application data\13597654\pc13597654ins (Rogue.Multiple) -> Quarantined and deleted successfully.

c:\program files\homeantivirus2010\pthreadvc2.dll (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\program files\homeantivirus2010\data\daily.cvd (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rloci.bin (Spyware.MarketScore) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\sporder.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\menu démarrer\programmes\homeantivirus2010\homeantivirus2010.lnk (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

c:\documents and settings\fred.xpsp2-7f13963dd\menu démarrer\programmes\homeantivirus2010\uninstall.lnk (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.

 

merci

[Apollo]

Bonjour,

 

Comment va l'ordinateur?

 

Fais ces vérifications de sécurité stp:

 

Apollo Et Compagnie :: A vérifier de temps en temps, important!

 

------------

@++

[loukebin]

rebonjour, désolé j'étais a ma competition...

c bon j'ai fait toutes les mises a jours.

[Apollo]

Re,

 

Télécharge DelFix sur ton bureau. Les Téléchargements - Outils de Xplode - DelFix

Lance-le et appuie sur le bouton [Recherche]

Copie tout le contenu du texte qui s'ouvre et colle-le dans ta réponse.

 

Note : Le rapport est sauvegardé sous C:\DelFixSearch.txt

 

------------------------

 

Relance Delfix et appuie sur le bouton [suppression]

Copie tout le contenu du fichier texte qui s'ouvre et colle-le dans ta réponse.

 

Note : Le rapport est sauvegardé sous C:\DelFixSuppr.txt

 

Tu peux ensuite relancer DelFix et appuyer sur [Désinstaller] afin de supprimer toute trace de son utilisation.

 

--------------------------

Désactiver la Restauration Système.

 

Menu Démarrer/Tous les programmes/Accessoires/Outils Système/

 

Cliquer sur Restauration Système.

 

Cliquer sur "Paramètres de la restauration du système; cocher la case: "Désactiver la Restauration du système sur tous les lecteurs"

Appliquer/OK.

 

Pour réactiver la Restauration système, suivre le même chemin et décocher la case. Appliquer/OK.

 

Un nouveau point de restauration sera automatiquement créé.

 

++

[loukebin]

merci

voila le rapport de la recherche :

 

# DelFix v8.7 - Rapport créé le 09/12/2011 à 13:21:29

# Mis à jour le 01/12/11 à 20h par Xplode

# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)

# Nom d'utilisateur : Fred - XPSP2-7F13963DD (Administrateur)

# Exécuté depuis : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\delfix.exe

# Option [Recherche]

 

 

~~~~~~ Dossiers(s) ~~~~~~

 

Présent : C:\ZHP

Présent : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RK_Quarantine

 

~~~~~~ Fichier(s) ~~~~~~

 

Présent : C:\TDSSKiller.2.5.1.0_08.12.2011_22.53.48_log.txt

Présent : C:\TDSSKiller.2.5.1.0_08.12.2011_23.02.04_log.txt

Présent : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RKreport[1].txt

Présent : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RKreport[2].txt

Présent : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RogueKiller.com

Présent : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\tdsskiller.zip

Présent : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\ZHPDiag2.exe

 

~~~~~~ Registre ~~~~~~

 

Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ZHP

 

~~~~~~ Autres ~~~~~~

 

 

*************************

 

DelFix[R1].txt - [1217 octets] - [09/12/2011 13:21:29]

 

########## EOF - C:\DelFix[R1].txt - [1341 octets] ##########

[loukebin]

voici le rapport de la suppression :

 

# DelFix v8.7 - Rapport créé le 09/12/2011 à 13:22:11

# Mis à jour le 01/12/11 à 20h par Xplode

# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)

# Nom d'utilisateur : Fred - XPSP2-7F13963DD (Administrateur)

# Exécuté depuis : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\delfix.exe

# Option [suppression]

 

 

~~~~~~ Dossiers(s) ~~~~~~

 

Supprimé : C:\ZHP

Supprimé : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RK_Quarantine

 

~~~~~~ Fichier(s) ~~~~~~

 

Supprimé : C:\TDSSKiller.2.5.1.0_08.12.2011_22.53.48_log.txt

Supprimé : C:\TDSSKiller.2.5.1.0_08.12.2011_23.02.04_log.txt

Supprimé : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RKreport[1].txt

Supprimé : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RKreport[2].txt

Supprimé : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\RogueKiller.com

Supprimé : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\tdsskiller.zip

Supprimé : C:\Documents and Settings\Fred.XPSP2-7F13963DD\Bureau\ZHPDiag2.exe

 

~~~~~~ Registre ~~~~~~

 

Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ZHP

 

~~~~~~ Autres ~~~~~~

 

-> Prefetch Vidé

 

*************************

 

DelFix[R1].txt - [1338 octets] - [09/12/2011 13:21:29]

DelFix[s1].txt - [1303 octets] - [09/12/2011 13:22:11]

 

########## EOF - C:\DelFix[s1].txt - [1427 octets] ##########