Pop Ups "en veux-tu en voilà..."

[neosapri]

Même chose, il remet erreur sur la page

 

Détails : erreur : cet objet ne gère pas cette propriété ou cette méthode...

 

Et si je "fixe" la ligne dans Hijack, je dois réinstaller l'active X... :-s

 

Ca tourne en rond et tant qu'on ne sort pas du rond point, on n'avance pas

[bruce lee]

ah décidement je suppose que avec kaspersky non plus ca ne marche pas?

 

on va verifier que tu n'es pas de bestiole qui se lance en silence.

 

1/telecharge silent runners http://www.silentrunners.org/Silent%20Runners.vbs

 

2/déconnecte toi du net et ferme toutes les applications en cours.

 

3/lance silent runners laisse le travailler quand il aura finit de scanner tu en sauras averti par un message et un nouveau fichier texte sera crée ouvre ce fichier texte et colle nous la totalité du rapport.

Modifié le 6 mars 2006 par bruce lee

[neosapri]

 

1/telecharge silent runners http://www.silentrunners.org/Silent%20Runners.vbs

 

 

C'est un fichier texte... :-S

[bruce lee]

comprends pas tout la, ou est le probleme?

[S.Birkoff]

Bonsoir bruce lee, neosapri,

 

LOL neosapri à bien raison ! Il faut pour le telechargement faire un clic droit sur le lien donné par bruce lee et choisir "Enregistrer la cible sous". Il ne reste plus qu à choisir l'endroit et à le telecharger.

Si l'on clique sur le lien, on tombe sur le contenu du fichier vbs !

 

Bonne soirée

Birkoff

Modifié le 6 mars 2006 par S.Birkoff

[neosapri]

Voilà ce qu'il y a sur la page que tu m'as donnée...

 

'Silent Runners.vbs -- find out what programs start up with Windows!

'

'DO NOT REMOVE THIS HEADER!

'

'Copyright Andrew ARONOFF 09 January 2006, http://www.silentrunners.org/

'This script is provided without any warranty, either expressed or implied

'It may not be copied or distributed without permission

'

'** YOU RUN THIS SCRIPT AT YOUR OWN RISK! **

'HEADER ENDS HERE

 

 

Option Explicit

 

Dim strRevNo : strRevNo = "43"

 

Public flagTest : flagTest = False 'True if testing

'flagTest = True 'Uncomment to test

 

'This script is divided into 27 sections.

 

'malware launch points:

' registry keys (I-XII, XV)

' INI/INF-files (XVI-XVIII)

' folders (XIX)

' enabled scheduled tasks (XX)

' Winsock2 service provider DLLs (XXI)

' IE toolbars, explorer bars, extensions (XXII)

' started services (XXVI)

' keyboard driver filters (XXVII)

 

'hijack points:

' System/Group Policies (XIV)

' prefixes for IE URLs (XXIII)

' misc IE points (XXIV)

' HOSTS file (XXV)

 

'Output is suppressed if deemed normal unless the -all parameter is used

'Sections XVIII & XXII-dormant Explorer Bars are skipped unless the -supp/-all

' parameters are used or the first message box is answered "No"

 

' I. HKCU/HKLM... Run/RunOnce/RunOnce\Setup

' HKLM... RunOnceEx/RunServices/RunServicesOnce

' HKCU/HKLM... Policies\Explorer\Run

' II. HKLM... Active Setup\Installed Components\

' HKCU... Active Setup\Installed Components\

' (StubPath <> "" And HKLM version # > HKCU version #)

' III. HKLM... Explorer\Browser Helper Objects\

' IV. HKLM... Shell Extensions\Approved\

' V. HKLM... Explorer\SharedTaskScheduler/ShellExecuteHooks

' VI. HKCU/HKLM... ShellServiceObjectDelayLoad\

' VII. HKCU... Command Processor\AutoRun ((default) <> "")

' HKCU... Policies\System\Shell (W2K & WXP only)

' HKCU... Windows\load & run ((default) <> "")

' HKCU... Command Processor\AutoRun ((default) <> "")

' HKLM... Windows\AppInit_DLLs ((default) <> "")

' HKLM... Winlogon\Shell/Userinit/System/Ginadll/Taskman

' ((default) <> explorer.exe, userinit.exe, "", "", "")

' HKLM... Control\SafeBoot\Option\UseAlternateShell

' HKLM... Control\Session Manager\BootExecute

' VIII. HKLM... Winlogon\Notify\ (subkey names/DLLName values <> O/S-specific dictionary data)

' IX. HKLM... Image File Execution Options\ (subkeys with name = "Debugger")

' X. HKCU/HKLM... Policies... Startup/Shutdown, Logon/Logoff

' XI. HKCR Protocols\Filter

' XII. Context menu shell extensions

' XIII. HKCR executable file type (bat/cmd/com/exe/hta/pif/scr)

' (shell\open\command data <> "%1" %*; hta <> mshta.exe "%1" %*; scr <> "%1" /S)

' XIV. System/Group Policies

' XV. Enabled Wallpaper & Screen Saver

' XVI. WIN.INI (load/run <> ""), SYSTEM.INI (shell <> explorer.exe, scrnsave.exe), WINSTART.BAT

' XVII. AUTORUN.INF in root of fixed drive (

 

...

...

 

et caetera etc

[bruce lee]

bonsoir S.Birkoff

 

je viens d'essayer en faisant un clique gauche dessus et ca marche comprends pas tout

 

fait ce qu'a marqué S.Birkoff et poste le resultat je le regarderai demain(a mois que quelqu'un d'autres s'en charge)

 

@+ tout le monde

Modifié le 6 mars 2006 par bruce lee

[neosapri]

et voilà...

 

"Silent Runners.vbs", revision 43, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

 

 

Startup items buried in registry:

---------------------------------

 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

"msnmsgr" = ""C:\Program Files\MSN Messenger\msnmsgr.exe" /background" [MS]

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]

"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]

"CloneCDElbyCDFL" = ""C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL" ["Elaborate Bytes"]

"GhostStartTrayApp" = "C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe" ["Symantec Corporation"]

"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]

"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]

"HP Software Update" = ""C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"" ["Hewlett-Packard Company"]

"HP Component Manager" = ""C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"" ["Hewlett-Packard Company"]

"MessengerPlus3" = ""C:\Program Files\MessengerPlus! 3\MsgPlus.exe"" ["Patchou"]

"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]

"IpNetwork" = "C:\Program Files\Network\ipnetwork.exe" [file not found]

"WinPatrol" = "C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe" ["BillP Studios"]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"

-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Symantec\Norton Ghost 2003\GhoShExt.dll" ["Symantec Corporation"]

"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"

-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"

-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"]

 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]

 

HKLM\Software\Classes\PROTOCOLS\Filter\

INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

 

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

 

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

 

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

 

 

Active Desktop and Wallpaper:

-----------------------------

 

Active Desktop is enabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

 

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

 

Active Desktop web content:

 

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\

"FriendlyName" = ""

"Source" = "C:\WINDOWS\system32\ad.html"

"SubscribedURL" = ""

 

 

Startup items in "xcfgdxfgxf" & "All Users" startup folders:

------------------------------------------------------------

 

C:\Documents and Settings\xcfgdxfgxf\Menu Démarrer\Programmes\Démarrage

"RegFreeze" -> shortcut to: "C:\Program Files\RegFreeze\regfreeze.exe" ["ActualResearch.com"]

 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

"Démarrage rapide du logiciel HP Image Zone" -> shortcut to: "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe -s" [null data]

"HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."]

"hp psc 1000 series" -> shortcut to: "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe" ["Hewlett-Packard Co."]

"hpoddt01.exe" -> shortcut to: "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]

"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]

 

 

Enabled Scheduled Tasks:

------------------------

 

"FRU Task #Hewlett-Packard#hp psc 1100 series#1122125453" -> launches: "C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe -I "#Hewlett-Packard#hp psc 1100 series#1122125453"" [empty string]

 

 

Winsock2 Service Provider DLLs:

-------------------------------

 

Namespace Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

 

Transport Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

 

 

Toolbars, Explorer Bars, Extensions:

------------------------------------

 

Extensions (Tools menu items, main toolbar menu buttons)

 

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Console Java (Sun)"

"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

 

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

"ButtonText" = "Recherche"

 

 

Miscellaneous IE Hijack Points

------------------------------

 

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

 

Added lines (compared with English-language version):

[strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

 

Missing lines (compared with English-language version):

[strings]: 1 line

 

 

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------

 

ewido security suite control, ewido security suite control, "C:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"]

GhostStartService, GhostStartService, "C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe" ["Symantec Corporation"]

Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS]

Norton Unerase Protection, NProtectService, "C:\Program Files\Norton Utilities\NPROTECT.EXE" ["Symantec Corporation"]

Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\system32\HPZipm12.exe" ["HP"]

SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]

Speed Disk service, Speed Disk service, "C:\Program Files\Speed Disk\nopdb.exe" ["Symantec Corporation"]

 

 

Print Monitors:

---------------

 

HKLM\System\CurrentControlSet\Control\Print\Monitors\

hpzsnt07\Driver = "hpzsnt07.dll" ["HP"]

Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]

 

 

----------

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

DLL launch points and all Registry CLSIDs for dormant Explorer Bars,

use the -supp parameter or answer "No" at the first message box.

---------- (total run time: 37 seconds, including 18 seconds for message boxes)

[bruce lee]

bonsoir,

le rapport de silent runenrs est propre on va essayer encore un autre scan en ligne mais celui la marche aussi avec firefox( pu qu'a esperer )

 

http://translate.google.com/translate?hl=f...ficial%26sa%3DG

 

si le scan en ligne marche post le resultat a la fin

 

@+

[neosapri]

MALWARES

 

Troj_DLOADER.BYU (2 infections)

.BUJ (1)

AGENT.AWA (2)

CLICKER.IC (2)

DLOADER.CCO (1)

SMALL.BGX (1)

 

GRAYWARES

 

ADW_COMMAD.C (2)

_SOFTOMATE.G (2)

_TARGETSAV.C (1)

 

FAILLES DE SECURITE

 

MS04-038

-043

-044

 

MS05-

001

004

007

008

011

012

013

014

015

016

018

019

020

025

026

027

032

033

036

037

038

039

040

041

042

043

045

046

047

048

049

050

051

052

053

054

 

MS06-

001

002

005

006

007

008

 

Voilà la liste

 

Faut faire "Nettoyer" via le site ou pas?

 

J'attends impatiemmment