Hum, le joli PC infecté.
Désactive la restauration système et démarre en sans echec.
Fixe ceci avec Hijack-This:
Citation:
C:\Documents and Settings\Propriétaire\Application Data\WinButler\WinButler.exe
Inconnu
C:\Documents and Settings\Propriétaire\Application Data\Microsoft\Windows\jmgilbp.exe
C:\windows\system32\esmbgdiyp.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: (no name) - {9AF34EBB-1D7F-6B45-2AED-515DBABAC218} - (no file)
O2 - BHO: (no name) - {A65E4B0B-F0E9-F96D-9E3B-FFBAAA3F1BC2} - (no file)
O2 - BHO: (no name) - {DD248EDD-720B-35D3-65D6-60ED9D652AA7} - (no file)
O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\User new.exe
O4 - HKLM\..\Run: [SVCHOST] C:\WINDOWS\MDM.EXE
O4 - HKCU\..\Run: [plus build] C:\DOCUME~1\PROPRI~1\APPLIC~1\SLOWWA~1\teamglue.ex e
O4 - HKCU\..\Run: [Instant Access] C:\WINDOWS\system32\lnaccess.exe /res
O4 - HKCU\..\Run: [WinButler] C:\Documents and Settings\Propriétaire\Application Data\WinButler\WinButler.exe
O4 - HKCU\..\Run: [SfKg6wIPu] C:\Documents and Settings\Propriétaire\Application Data\Microsoft\Windows\jmgilbp.exe
O4 - HKCU\..\Run: [esmbgdiyp] c:\windows\system32\esmbgdiyp.exe esmbgdiyp
O4 - HKCU\..\Run: [xdlapxpdi] c:\windows\system32\xdlapxpdi.exe xdlapxpdi
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb123\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb123\Dealio.dll
O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgUS2404.exe
O20 - Winlogon Notify: winowl32 - winowl32.dll (file missing)
|
Supprime les fichiers correspondant manuellement(ex: Dealio.dll,etc...).
Passe un coup de Spybot et d'Antivirus. Nettoie le registre via TuneUp.
Redémarre. Rétablis le mode normal et la restauration système.
