Infection Bagle ...
Rodo-15
Messages postés
108
Statut
Membre
-
toptitbal Messages postés 26224 Date d'inscription Statut Contributeur sécurité Dernière intervention -
toptitbal Messages postés 26224 Date d'inscription Statut Contributeur sécurité Dernière intervention -
Bonjour à tous ! voila je crois que je suis infecté par bagle ( PC qui rame + avast non valide )
Est ce que quelqu'un aurai la gentillesse de m'aidé à me débarasser de cette saleté de virus...
Merci d'avance =) !!
Est ce que quelqu'un aurai la gentillesse de m'aidé à me débarasser de cette saleté de virus...
Merci d'avance =) !!
A voir également:
- Infection Bagle ...
- Infection ad.doubleclick.net ✓ - Forum Virus
- Infection FileRepMetagen - Forum Virus
- Infection WonderShare ✓ - Forum Virus
- Infection winrmsrv ✓ - Forum Virus
- Infection fahcore_a8 ✓ - Forum Virus
9 réponses
Bonjour
Télécharge FindyKill de Chiquitine29 :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
->Enregistre-le sur ton bureau et pas ailleurs !
!! Déconnecte toi et ferme toutes les applications en cours !!
( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)
-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.
Tuto : https://www.malekal.com/tutorial-findykill/
--> Double-clique sur le raccourci " FindyKill " qui est sur ton bureau .
-->choisis l'option 1 ( recherche ). Puis laisse travailler l'outil sans rien toucher ...
Une fois terminé, poste le rapport FindyKill.txt qui est généré ...
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
Télécharge FindyKill de Chiquitine29 :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
->Enregistre-le sur ton bureau et pas ailleurs !
!! Déconnecte toi et ferme toutes les applications en cours !!
( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)
-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.
Tuto : https://www.malekal.com/tutorial-findykill/
--> Double-clique sur le raccourci " FindyKill " qui est sur ton bureau .
-->choisis l'option 1 ( recherche ). Puis laisse travailler l'outil sans rien toucher ...
Une fois terminé, poste le rapport FindyKill.txt qui est généré ...
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
###################### [ FindyKill V4.714 ]
# User : Rodo - 1041425703126
# Emplacement : C:\Program Files\FindyKill
# Outils Mis a jours le 19/01/09 par Chiquitine29
# Recherche effectuée à 15:10:58 le 24/01/2009
# Windows XP - Internet Explorer 7.0.5730.13
# [ FindyKill V4.714 - Scan ] ##############
\\\\\\\\\\\\\\\\\\\\ [ Processus actifs ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
D:\documents and settings\rodo.1041425703126\local settings\application data\wiygc.exe
D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe
D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld\1497843.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Internet Explorer\iexplore.exe
\\\\\\\\\\\\\\\\\\ [ Processus infectieux stoppés ] ///////////////////
"D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe" (1792)
"D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe" (924)
"D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld\1497843.exe" (3860)
"C:\WINDOWS\system32\wintems.exe" (3676)
\\\\\\\\\\\\\\\\\\ [ Fichiers/Dossiers infectieux ] ///////////////////
################## [ C:\ ]
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Found ! - C:\WINDOWS\prefetch\1356640.EXE-0F03EEC0.pf
Found ! - C:\WINDOWS\prefetch\1385921.EXE-035BA7DC.pf
Found ! - C:\WINDOWS\prefetch\1497843.EXE-19D831E6.pf
Found ! - C:\WINDOWS\prefetch\1519796.EXE-2186675D.pf
Found ! - C:\WINDOWS\prefetch\1647609.EXE-3A43413F.pf
Found ! - C:\WINDOWS\prefetch\1873609.EXE-24E22891.pf
Found ! - C:\WINDOWS\prefetch\416015.EXE-02D84331.pf
Found ! - C:\WINDOWS\prefetch\444953.EXE-2012FE35.pf
Found ! - C:\WINDOWS\prefetch\471671.EXE-2AEC1A78.pf
Found ! - C:\WINDOWS\prefetch\510328.EXE-2C2E4018.pf
Found ! - C:\WINDOWS\prefetch\517828.EXE-2A219C84.pf
Found ! - C:\WINDOWS\prefetch\573171.EXE-32AB4692.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-34642C78.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf
Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-1869F0D6.pf
################## [ C:\WINDOWS\system32 ]
Found ! [24/01/2009 14:30] - C:\WINDOWS\system32\mdelk.exe
Found ! [24/01/2009 14:30] - C:\WINDOWS\system32\wintems.exe
Found ! [24/01/2009 14:32] - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ D:\Documents and Settings\Rodo.1041425703126\Application Data ]
Found ! [24/01/2009 14:13] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe"
Found ! [24/01/2009 14:14] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\list.oct"
Found ! [24/01/2009 14:15] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\data.oct"
Found ! [24/01/2009 14:15] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\srvlist.oct"
Found ! [24/01/2009 14:16] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\shared"
Found ! [24/01/2009 12:54] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m"
Found ! [24/01/2009 12:40] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers"
Found ! [24/01/2009 14:05] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\srosa2.sys"
Found ! [24/01/2009 14:05] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\wfsintwq.sys"
Found ! [24/02/2005 01:10] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe"
Found ! [24/01/2009 14:30] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld"
################## [ D:\DOCUME~1\RODO~1.104\LOCALS~1\Temp ]
\\\\\\\\\\\\\\\\\\ [ Registre / Startup ] ///////////////////
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
Picasa Media Detector=C:\Program Files\Picasa2\PicasaMediaDetector.exe
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
UpdateWin=C:\WINDOWS\system32\amstreamd.exe
yqoaiyu="d:\documents and settings\rodo.1041425703126\local settings\application data\yqoaiyu.exe" yqoaiyu
wiygc="d:\documents and settings\rodo.1041425703126\local settings\application data\wiygc.exe" wiygc
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
Raccourci vers la page des propriétés de High Definition Audio=HDAudPropShortcut.exe
SoundMan=SOUNDMAN.EXE
AlcWzrd=ALCWZRD.EXE
Alcmtr=ALCMTR.EXE
ATIPTA="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
SunJavaUpdateSched=C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
Ulead AutoDetector v2=C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
PCMService="c:\Apps\Powercinema\PCMService.exe"
IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
ACTIVBOARD=c:\apps\ABoard\ABoard.exe
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
WinampAgent="C:\Program Files\Winamp\winampa.exe"
QuickTime Task="C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
LogitechCommunicationsManager="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
<NO NAME>=
LogitechQuickCamRibbon="C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
Blubster=C:\Program Files\Blubster\Blubster.exe SILENT
[HKEY_CURRENT_USER\software\local appwizard-generated applications\MsnMsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\setup]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]
\\\\\\\\\\\\\\\\\\ [ Registre / Clés infectieuses ] ///////////////////
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | drvsyskit
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | german.exe
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | mule_st_key
/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1
\\\\\\\\\\\\\\\\\\ [ Etat / Services ] ///////////////////
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
/!\ Mode sans echec non fonctionnel !!
# Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - # Type de démarrage = 4
EapHost - # Type de démarrage = 3
/!\ Ip6Fw - # Type de démarrage = 4
/!\ SharedAccess - # Type de démarrage = 4
/!\ wuauserv - # Type de démarrage = 4
/!\ wscsvc - # Type de démarrage = 4
\\\\\\\\\\\\\\\\\\ [ Recherche dans supports amovibles] ///////////////////
# Informations :
C: - Lecteur fixe
D: - Lecteur fixe
# presence des fichiers :
\\\\\\\\\\\\\\\\\\ [ Registre / Mountpoint2 ] ///////////////////
-> Not found !
################## [ ! Fin du rapport # FindyKill V4.714 ! ]
# User : Rodo - 1041425703126
# Emplacement : C:\Program Files\FindyKill
# Outils Mis a jours le 19/01/09 par Chiquitine29
# Recherche effectuée à 15:10:58 le 24/01/2009
# Windows XP - Internet Explorer 7.0.5730.13
# [ FindyKill V4.714 - Scan ] ##############
\\\\\\\\\\\\\\\\\\\\ [ Processus actifs ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
D:\documents and settings\rodo.1041425703126\local settings\application data\wiygc.exe
D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe
D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld\1497843.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Internet Explorer\iexplore.exe
\\\\\\\\\\\\\\\\\\ [ Processus infectieux stoppés ] ///////////////////
"D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe" (1792)
"D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe" (924)
"D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld\1497843.exe" (3860)
"C:\WINDOWS\system32\wintems.exe" (3676)
\\\\\\\\\\\\\\\\\\ [ Fichiers/Dossiers infectieux ] ///////////////////
################## [ C:\ ]
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Found ! - C:\WINDOWS\prefetch\1356640.EXE-0F03EEC0.pf
Found ! - C:\WINDOWS\prefetch\1385921.EXE-035BA7DC.pf
Found ! - C:\WINDOWS\prefetch\1497843.EXE-19D831E6.pf
Found ! - C:\WINDOWS\prefetch\1519796.EXE-2186675D.pf
Found ! - C:\WINDOWS\prefetch\1647609.EXE-3A43413F.pf
Found ! - C:\WINDOWS\prefetch\1873609.EXE-24E22891.pf
Found ! - C:\WINDOWS\prefetch\416015.EXE-02D84331.pf
Found ! - C:\WINDOWS\prefetch\444953.EXE-2012FE35.pf
Found ! - C:\WINDOWS\prefetch\471671.EXE-2AEC1A78.pf
Found ! - C:\WINDOWS\prefetch\510328.EXE-2C2E4018.pf
Found ! - C:\WINDOWS\prefetch\517828.EXE-2A219C84.pf
Found ! - C:\WINDOWS\prefetch\573171.EXE-32AB4692.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-34642C78.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf
Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-1869F0D6.pf
################## [ C:\WINDOWS\system32 ]
Found ! [24/01/2009 14:30] - C:\WINDOWS\system32\mdelk.exe
Found ! [24/01/2009 14:30] - C:\WINDOWS\system32\wintems.exe
Found ! [24/01/2009 14:32] - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ D:\Documents and Settings\Rodo.1041425703126\Application Data ]
Found ! [24/01/2009 14:13] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe"
Found ! [24/01/2009 14:14] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\list.oct"
Found ! [24/01/2009 14:15] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\data.oct"
Found ! [24/01/2009 14:15] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\srvlist.oct"
Found ! [24/01/2009 14:16] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\shared"
Found ! [24/01/2009 12:54] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m"
Found ! [24/01/2009 12:40] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers"
Found ! [24/01/2009 14:05] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\srosa2.sys"
Found ! [24/01/2009 14:05] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\wfsintwq.sys"
Found ! [24/02/2005 01:10] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe"
Found ! [24/01/2009 14:30] - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld"
################## [ D:\DOCUME~1\RODO~1.104\LOCALS~1\Temp ]
\\\\\\\\\\\\\\\\\\ [ Registre / Startup ] ///////////////////
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
Picasa Media Detector=C:\Program Files\Picasa2\PicasaMediaDetector.exe
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
UpdateWin=C:\WINDOWS\system32\amstreamd.exe
yqoaiyu="d:\documents and settings\rodo.1041425703126\local settings\application data\yqoaiyu.exe" yqoaiyu
wiygc="d:\documents and settings\rodo.1041425703126\local settings\application data\wiygc.exe" wiygc
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
Raccourci vers la page des propriétés de High Definition Audio=HDAudPropShortcut.exe
SoundMan=SOUNDMAN.EXE
AlcWzrd=ALCWZRD.EXE
Alcmtr=ALCMTR.EXE
ATIPTA="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
SunJavaUpdateSched=C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
Ulead AutoDetector v2=C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
PCMService="c:\Apps\Powercinema\PCMService.exe"
IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
ACTIVBOARD=c:\apps\ABoard\ABoard.exe
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
WinampAgent="C:\Program Files\Winamp\winampa.exe"
QuickTime Task="C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
LogitechCommunicationsManager="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
<NO NAME>=
LogitechQuickCamRibbon="C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
Blubster=C:\Program Files\Blubster\Blubster.exe SILENT
[HKEY_CURRENT_USER\software\local appwizard-generated applications\MsnMsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\setup]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]
\\\\\\\\\\\\\\\\\\ [ Registre / Clés infectieuses ] ///////////////////
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | drvsyskit
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | german.exe
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | mule_st_key
/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1
\\\\\\\\\\\\\\\\\\ [ Etat / Services ] ///////////////////
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
/!\ Mode sans echec non fonctionnel !!
# Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - # Type de démarrage = 4
EapHost - # Type de démarrage = 3
/!\ Ip6Fw - # Type de démarrage = 4
/!\ SharedAccess - # Type de démarrage = 4
/!\ wuauserv - # Type de démarrage = 4
/!\ wscsvc - # Type de démarrage = 4
\\\\\\\\\\\\\\\\\\ [ Recherche dans supports amovibles] ///////////////////
# Informations :
C: - Lecteur fixe
D: - Lecteur fixe
# presence des fichiers :
\\\\\\\\\\\\\\\\\\ [ Registre / Mountpoint2 ] ///////////////////
-> Not found !
################## [ ! Fin du rapport # FindyKill V4.714 ! ]
Important :
Branche toutes tes unités externes au PC ( DD externes, clé USB, lecteur mp3, ect...) mais sans les ouvrir !
Tu les retireras après la manip ...
Ferme toutes les applications en cours !
Relance FindyKill :
-> choisis cette fois-ci l'option 2 (suppression).
/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message :
"nettoyage terminé" .
Note : lors du message d'avertissement , cliques sur " Ok " .
--> Poste le nouveau rapport FindyKill.txt qui est généré.
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tapes explorer.exe et valide .
Branche toutes tes unités externes au PC ( DD externes, clé USB, lecteur mp3, ect...) mais sans les ouvrir !
Tu les retireras après la manip ...
Ferme toutes les applications en cours !
Relance FindyKill :
-> choisis cette fois-ci l'option 2 (suppression).
/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message :
"nettoyage terminé" .
Note : lors du message d'avertissement , cliques sur " Ok " .
--> Poste le nouveau rapport FindyKill.txt qui est généré.
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tapes explorer.exe et valide .
###################### [ FindyKill V4.714 ]
# User : Rodo - 1041425703126
# Executed from : C:\Program Files\FindyKill
# Update on 19/01/09 by Chiquitine29
# Start at 15:55:09 the 24/01/2009
# Windows XP - Internet Explorer 7.0.5730.13
# [ FindyKill V4.714 - Deleting ] ###############
\\\\\\\\\\\\\\\\\\ [ Active Processes ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wdfmgr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
\\\\\\\\\\\\\\\\\\ [ Infected Files / Folders ] ///////////////////
################## [ C:\ ]
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Deleted ! - C:\WINDOWS\prefetch\1356640.EXE-0F03EEC0.pf
Deleted ! - C:\WINDOWS\prefetch\1358343.EXE-0271D2F9.pf
Deleted ! - C:\WINDOWS\prefetch\1385921.EXE-035BA7DC.pf
Deleted ! - C:\WINDOWS\prefetch\1497843.EXE-19D831E6.pf
Deleted ! - C:\WINDOWS\prefetch\1519796.EXE-2186675D.pf
Deleted ! - C:\WINDOWS\prefetch\1647609.EXE-3A43413F.pf
Deleted ! - C:\WINDOWS\prefetch\1873609.EXE-24E22891.pf
Deleted ! - C:\WINDOWS\prefetch\416015.EXE-02D84331.pf
Deleted ! - C:\WINDOWS\prefetch\444953.EXE-2012FE35.pf
Deleted ! - C:\WINDOWS\prefetch\448453.EXE-263F9102.pf
Deleted ! - C:\WINDOWS\prefetch\471671.EXE-2AEC1A78.pf
Deleted ! - C:\WINDOWS\prefetch\510328.EXE-2C2E4018.pf
Deleted ! - C:\WINDOWS\prefetch\517828.EXE-2A219C84.pf
Deleted ! - C:\WINDOWS\prefetch\573171.EXE-32AB4692.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-34642C78.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-086F0B56.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-0EF461CE.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-1869F0D6.pf
################## [ C:\WINDOWS\system32 ]
Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ D:\Documents and Settings\Rodo.1041425703126\Application Data ]
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\list.oct"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\data.oct"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\srvlist.oct"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\shared"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\srosa2.sys"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\wfsintwq.sys"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers"
################## [ D:\DOCUME~1\RODO~1.104\LOCALS~1\Temp ]
################## [ D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5 ]
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\5R184NT1\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\91CV8XI8\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\BF6H6C8D\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\BF6H6C8D\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\BF6H6C8D\file[1].txt
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\b64[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\b64_1[2].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\G65HTRWU\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\G65HTRWU\b64_1[2].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\G65HTRWU\b64_2[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\b64[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\b64[2].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\servernames[1].htm
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\servernames[2].htm
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\Q43GBF68\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\Q43GBF68\file[1].txt
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\Q43GBF68\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\TK0H6L09\mxd[1].jpg
\\\\\\\\\\\\\\\\\\ [ Registry / Infected keys ] ///////////////////
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\FFC
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\MuleAppData
\\\\\\\\\\\\\\\\\\ [ States / Restarting of services ] ///////////////////
# Safe boot mode restored !
# Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - # Type of startup = 3
EapHost - # Type of startup = 2
Ip6Fw - # Type of startup = 2
SharedAccess - # Type of startup = 2
wuauserv - # Type of startup = 2
wscsvc - # Type of startup = 2
\\\\\\\\\\\\\\\\\\ [ Cleaning Removable drives ] ///////////////////
# Informations :
C: - Lecteur fixe
D: - Lecteur fixe
# deleting files :
\\\\\\\\\\\\\\\\\\ [ Registry / Mountpoint2 ] ///////////////////
-> Not found !
\\\\\\\\\\\\\\\\\\ [ Searching Other Infections ] ///////////////////
Références de comparaison Bagle MD5 :
6ad55374 D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe
eef5128e4f5bb18a548fd739c6ac40da D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe
Suspect ! - eef5128e4f5bb18a548fd739c6ac40da C:\Program Files\Windows Live\Messenger\msnmsgr.exe
\\\\\\\\\\\\\\\\\\ [ Searching Cracks / Keygen ] ///////////////////
################## [ ! End of report # FindyKill V4.714 ! ]
# User : Rodo - 1041425703126
# Executed from : C:\Program Files\FindyKill
# Update on 19/01/09 by Chiquitine29
# Start at 15:55:09 the 24/01/2009
# Windows XP - Internet Explorer 7.0.5730.13
# [ FindyKill V4.714 - Deleting ] ###############
\\\\\\\\\\\\\\\\\\ [ Active Processes ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wdfmgr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
\\\\\\\\\\\\\\\\\\ [ Infected Files / Folders ] ///////////////////
################## [ C:\ ]
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Deleted ! - C:\WINDOWS\prefetch\1356640.EXE-0F03EEC0.pf
Deleted ! - C:\WINDOWS\prefetch\1358343.EXE-0271D2F9.pf
Deleted ! - C:\WINDOWS\prefetch\1385921.EXE-035BA7DC.pf
Deleted ! - C:\WINDOWS\prefetch\1497843.EXE-19D831E6.pf
Deleted ! - C:\WINDOWS\prefetch\1519796.EXE-2186675D.pf
Deleted ! - C:\WINDOWS\prefetch\1647609.EXE-3A43413F.pf
Deleted ! - C:\WINDOWS\prefetch\1873609.EXE-24E22891.pf
Deleted ! - C:\WINDOWS\prefetch\416015.EXE-02D84331.pf
Deleted ! - C:\WINDOWS\prefetch\444953.EXE-2012FE35.pf
Deleted ! - C:\WINDOWS\prefetch\448453.EXE-263F9102.pf
Deleted ! - C:\WINDOWS\prefetch\471671.EXE-2AEC1A78.pf
Deleted ! - C:\WINDOWS\prefetch\510328.EXE-2C2E4018.pf
Deleted ! - C:\WINDOWS\prefetch\517828.EXE-2A219C84.pf
Deleted ! - C:\WINDOWS\prefetch\573171.EXE-32AB4692.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-34642C78.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-086F0B56.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-0EF461CE.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-1869F0D6.pf
################## [ C:\WINDOWS\system32 ]
Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ D:\Documents and Settings\Rodo.1041425703126\Application Data ]
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\flec006.exe"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\list.oct"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\data.oct"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\srvlist.oct"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m\shared"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\m"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\srosa2.sys"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\wfsintwq.sys"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\downld"
Deleted ! - "D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers"
################## [ D:\DOCUME~1\RODO~1.104\LOCALS~1\Temp ]
################## [ D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5 ]
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\5R184NT1\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\91CV8XI8\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\BF6H6C8D\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\BF6H6C8D\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\BF6H6C8D\file[1].txt
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\b64[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\b64_1[2].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\CI71D3BF\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\G65HTRWU\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\G65HTRWU\b64_1[2].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\G65HTRWU\b64_2[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\b64[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\b64[2].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\servernames[1].htm
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\OSG154C2\servernames[2].htm
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\Q43GBF68\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\Q43GBF68\file[1].txt
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\Q43GBF68\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Rodo.1041425703126\Local Settings\Temporary Internet Files\Content.IE5\TK0H6L09\mxd[1].jpg
\\\\\\\\\\\\\\\\\\ [ Registry / Infected keys ] ///////////////////
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\FFC
Deleted ! - HKEY_USERS\S-1-5-21-3546390197-3363290258-407648102-1006\Software\MuleAppData
\\\\\\\\\\\\\\\\\\ [ States / Restarting of services ] ///////////////////
# Safe boot mode restored !
# Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - # Type of startup = 3
EapHost - # Type of startup = 2
Ip6Fw - # Type of startup = 2
SharedAccess - # Type of startup = 2
wuauserv - # Type of startup = 2
wscsvc - # Type of startup = 2
\\\\\\\\\\\\\\\\\\ [ Cleaning Removable drives ] ///////////////////
# Informations :
C: - Lecteur fixe
D: - Lecteur fixe
# deleting files :
\\\\\\\\\\\\\\\\\\ [ Registry / Mountpoint2 ] ///////////////////
-> Not found !
\\\\\\\\\\\\\\\\\\ [ Searching Other Infections ] ///////////////////
Références de comparaison Bagle MD5 :
6ad55374 D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe
eef5128e4f5bb18a548fd739c6ac40da D:\Documents and Settings\Rodo.1041425703126\Application Data\drivers\winupgro.exe
Suspect ! - eef5128e4f5bb18a548fd739c6ac40da C:\Program Files\Windows Live\Messenger\msnmsgr.exe
\\\\\\\\\\\\\\\\\\ [ Searching Cracks / Keygen ] ///////////////////
################## [ ! End of report # FindyKill V4.714 ! ]
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
D'après le rapport FindyKill l'exe d'MSN s'est fait shooter par Bagle.
A moins bien sur que tu n'aies déjà réinstallé Windows Live, alors dans ce cas oublie ce qui suit :
Supprimes C:\Program Files\Windows Live\Messenger\msnmsgr.exe (S'il est infecté l'icone du fichier sera en forme de clé bleu)
Ensuite, ouvre le panneau de configuration -> Ajout/suppression de programmes -> Installation Windows Live -> Modifier/Supprimer -> Réparer
La procédure de réparation retéléchargera le fichier manquant et t'éviteras une réinstall totale du prog assez longuette :-).
Puis, si tu as redémarré ton pc alors que msnmsgr.exe était infecté, il est possible qu'un dossier relatif à l'infection se soit recrée (vide).
Vérifie et supprime-le s'il s'avère qu'il existe :
Rends visible les fichiers cachés et système et recherche et supprime :
C:\Documents and Settings\Muriel\Application Data\drivers
Recache ensuite les fichiers cachés et système.
Eventuellement si tu es à l'aise avec le registre, tu peux supprimer cette clé qui a du elle aussi être recrée en même temps que le dossier drivers:
HKEY_CURRENT_USER\Software\Bisoft
Démarrer > Executer > tape regedit et valide.
Déploies :
[+] HKEY_CURRENT_USER
[-] Software
|- Bisoft <- Clic dessus pour mettre en surbrillance puis clic droit, Supprimer.
(Merci à moe pour cette procédure)
A moins bien sur que tu n'aies déjà réinstallé Windows Live, alors dans ce cas oublie ce qui suit :
Supprimes C:\Program Files\Windows Live\Messenger\msnmsgr.exe (S'il est infecté l'icone du fichier sera en forme de clé bleu)
Ensuite, ouvre le panneau de configuration -> Ajout/suppression de programmes -> Installation Windows Live -> Modifier/Supprimer -> Réparer
La procédure de réparation retéléchargera le fichier manquant et t'éviteras une réinstall totale du prog assez longuette :-).
Puis, si tu as redémarré ton pc alors que msnmsgr.exe était infecté, il est possible qu'un dossier relatif à l'infection se soit recrée (vide).
Vérifie et supprime-le s'il s'avère qu'il existe :
Rends visible les fichiers cachés et système et recherche et supprime :
C:\Documents and Settings\Muriel\Application Data\drivers
Recache ensuite les fichiers cachés et système.
Eventuellement si tu es à l'aise avec le registre, tu peux supprimer cette clé qui a du elle aussi être recrée en même temps que le dossier drivers:
HKEY_CURRENT_USER\Software\Bisoft
Démarrer > Executer > tape regedit et valide.
Déploies :
[+] HKEY_CURRENT_USER
[-] Software
|- Bisoft <- Clic dessus pour mettre en surbrillance puis clic droit, Supprimer.
(Merci à moe pour cette procédure)
J'ai effectivement supprimé le fichier "msnmsgr.exe" qui était bien en icone de clé bleu, mais par contre je n'ai pas trouvé de fichier "Installation windows live" dans ajout/suppression de programmes.
Je n'ai pas trouve nom plus de fichier Bisoft dans "HKEY_CURRENT_USER\Software" mais juste un fichier dans la fenetre nommé (par defaut) de type REG_SZ avec une petite icone marqué "ab" en rouge..
Je n'ai pas trouve nom plus de fichier Bisoft dans "HKEY_CURRENT_USER\Software" mais juste un fichier dans la fenetre nommé (par defaut) de type REG_SZ avec une petite icone marqué "ab" en rouge..
Si tu n'as pas la possibilité de réparer WLM, tu vas être obligé de le réinstaller
Tu es sûr que tu n'as pas : "Windows Live Messenger" dans ajout/suppression de programmes ?
Tu es sûr que tu n'as pas : "Windows Live Messenger" dans ajout/suppression de programmes ?
