Virus facebook via email
Fermé
wadcox
Messages postés
998
Date d'inscription
dimanche 16 juillet 2006
Statut
Membre
Dernière intervention
22 septembre 2011
-
25 sept. 2009 à 11:33
Utilisateur anonyme - 25 sept. 2009 à 16:45
Utilisateur anonyme - 25 sept. 2009 à 16:45
A voir également:
- Virus facebook via email
- Compte facebook piraté - Guide
- Sondage facebook - Guide
- Qui regarde mon profil facebook - Guide
- Supprimer compte facebook - Guide
- Story facebook - Guide
8 réponses
Salut.
Pourquoi as-tu utilisé FindyKill ? Le rapport fourni n'est pas un hijackthis, mais RSIT ! ;)
Commence par ceci :
▶ Télécharge Malwarebytes Anti-Malware (MBAM):
MBAM
▶ Installe-le en vérifiant que la case de mise à jour soit bien cochée en fin d'installation.
▶ Après la mise à jour, lance-le et coche "Examen Rapide". Puis "Rechercher".
▶ Si MBAM trouve quelque chose: fais "Voir les résultats" puis "Supprimer la sélection".
▶ Poste le rapport généré.
++
Pourquoi as-tu utilisé FindyKill ? Le rapport fourni n'est pas un hijackthis, mais RSIT ! ;)
Commence par ceci :
▶ Télécharge Malwarebytes Anti-Malware (MBAM):
MBAM
▶ Installe-le en vérifiant que la case de mise à jour soit bien cochée en fin d'installation.
▶ Après la mise à jour, lance-le et coche "Examen Rapide". Puis "Rechercher".
▶ Si MBAM trouve quelque chose: fais "Voir les résultats" puis "Supprimer la sélection".
▶ Poste le rapport généré.
++
wadcox
Messages postés
998
Date d'inscription
dimanche 16 juillet 2006
Statut
Membre
Dernière intervention
22 septembre 2011
222
25 sept. 2009 à 12:17
25 sept. 2009 à 12:17
re,
merci déjà de t'occuper de mon problème.
malwarebytes a été le premier logiciel que j'ai utilisé avant de poster ici, j'ai fait la maj, lancé une analyse complète. supprimé des spywares et autres cochonneries. je relance le pc et je relance internet et hop, je lance ma page de démarrage (google) aucun soucis, je fais une recherche avec le mot test par exemple.
j'ai tous les résultats (aucun soucis), et une fois que je clic sur n importe quel site dans les résultats, je suis directement renvoyé vers d'autres sites du style ebay, ou autres sites différents de celui que je recherche.
j'ai fais le test malwarebytes en mode normal et sans echec avec prise en charge réseau.
supprimé au max tout ce qu'il y avait au démarrage du pc au cas ou cela viendrait de là.
supprimé tout le contenu des fichiers temps (C: windows/temp, c:documents and settind...)
mais rien n'y fait.
je pourrai formater mais je voudrais arrivé à bout de ce satané virus plutôt que te me lancer dans un formatage facile.
merci déjà de t'occuper de mon problème.
malwarebytes a été le premier logiciel que j'ai utilisé avant de poster ici, j'ai fait la maj, lancé une analyse complète. supprimé des spywares et autres cochonneries. je relance le pc et je relance internet et hop, je lance ma page de démarrage (google) aucun soucis, je fais une recherche avec le mot test par exemple.
j'ai tous les résultats (aucun soucis), et une fois que je clic sur n importe quel site dans les résultats, je suis directement renvoyé vers d'autres sites du style ebay, ou autres sites différents de celui que je recherche.
j'ai fais le test malwarebytes en mode normal et sans echec avec prise en charge réseau.
supprimé au max tout ce qu'il y avait au démarrage du pc au cas ou cela viendrait de là.
supprimé tout le contenu des fichiers temps (C: windows/temp, c:documents and settind...)
mais rien n'y fait.
je pourrai formater mais je voudrais arrivé à bout de ce satané virus plutôt que te me lancer dans un formatage facile.
Salut
Ici c'est le forum Windows, merci de poster les problèmes de Virus/Sécurité dans le forum approprié.
D'autre part, il est recommandé d'attendre les conseils des helpers avant de faire un quelconque rapport.
Bonne chance pour la désinfection!
Ici c'est le forum Windows, merci de poster les problèmes de Virus/Sécurité dans le forum approprié.
D'autre part, il est recommandé d'attendre les conseils des helpers avant de faire un quelconque rapport.
Bonne chance pour la désinfection!
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
wadcox
Messages postés
998
Date d'inscription
dimanche 16 juillet 2006
Statut
Membre
Dernière intervention
22 septembre 2011
222
25 sept. 2009 à 15:54
25 sept. 2009 à 15:54
voici le rapport avant de supprimés les fichiers infectés, puis après le rapport une fois supprimés :
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2
25/09/2009 15:40:00
mbam-log-2009-09-25 (15-39-46).txt
Scan type: Full Scan (C:\|)
Objects scanned: 251301
Time elapsed: 48 minute(s), 32 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 76
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\program files\ddnsfilter\ddnsfilter.dll (Trojan.DNSChanger) -> No action taken.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ddnsfilter (Trojan.DNSChanger) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ddnsfilter (Trojan.DNSChanger) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddnsfilter (Trojan.DNSChanger) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> No action taken.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\ddnsfilter (Trojan.DNSChanger) -> No action taken.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.
Folders Infected:
C:\Program Files\DDnsFilter (Trojan.DNSChanger) -> No action taken.
Files Infected:
C:\1utbfd.bat (Spyware.OnlineGames) -> No action taken.
C:\22yj2fy1.exe (Worm.AutoRun) -> No action taken.
C:\6rxt26.exe (Worm.Magania) -> No action taken.
C:\hx.exe (Spyware.OnlineGames) -> No action taken.
C:\kgji.exe (Worm.Magania) -> No action taken.
C:\lcw.exe (Spyware.OnlineGames) -> No action taken.
C:\m1eqos3.exe (Worm.Magania) -> No action taken.
C:\mb9x.exe (Worm.Magania) -> No action taken.
C:\rx.exe (Worm.Magania) -> No action taken.
C:\u0riu2.exe (Spyware.OnlineGames) -> No action taken.
C:\ukfbi3aw.exe (Worm.Magania) -> No action taken.
C:\nkbd1v.exe (Spyware.OnlineGames) -> No action taken.
C:\p0ijj.bat (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091286.bat (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091293.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092287.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092327.dll (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092329.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092333.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092334.dll (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092401.dll (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092481.bat (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092546.dll (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092892.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092736.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092810.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0092954.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0093036.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093142.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093203.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093443.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093297.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093373.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093460.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093488.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP410\A0095220.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095231.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095663.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0095987.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096206.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096105.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0096285.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097361.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097477.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097568.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097663.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097761.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097851.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097908.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP418\A0098044.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP419\A0098452.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098459.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098576.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098682.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098765.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098851.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\hippy14.exe (Worm.Koobface) -> No action taken.
C:\Program Files\DDnsFilter\DDnsFilter.dll (Trojan.DNSChanger) -> No action taken.
C:\WINDOWS\nlmark2.dat (KoobFace.Trace) -> No action taken.
C:\autorun.inf (SuspectAutorun.Rootdrive.H) -> No action taken.
C:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds1.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds2.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds3.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\010112010146116101.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465050.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465249.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465349.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465354.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465549.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\mmsmark2.dat (KoobFace.Trace) -> No action taken.
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2
25/09/2009 15:40:27
mbam-log-2009-09-25 (15-40-27).txt
Scan type: Full Scan (C:\|)
Objects scanned: 251301
Time elapsed: 48 minute(s), 32 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 76
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\program files\ddnsfilter\ddnsfilter.dll (Trojan.DNSChanger) -> Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Folders Infected:
C:\Program Files\DDnsFilter (Trojan.DNSChanger) -> Delete on reboot.
Files Infected:
C:\1utbfd.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\22yj2fy1.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\6rxt26.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\hx.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\kgji.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\lcw.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\m1eqos3.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\mb9x.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\rx.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\u0riu2.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\ukfbi3aw.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\nkbd1v.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\p0ijj.bat (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091286.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091293.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092287.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092327.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092329.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092333.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092334.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092401.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092481.bat (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092546.dll (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092892.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092736.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092810.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0092954.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0093036.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093142.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093203.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093443.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093297.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093373.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093460.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093488.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP410\A0095220.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095231.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095663.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0095987.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096206.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096105.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0096285.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097361.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097477.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097568.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097663.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097761.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097851.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097908.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP418\A0098044.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP419\A0098452.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098459.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098576.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098682.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098765.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098851.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\hippy14.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:\Program Files\DDnsFilter\DDnsFilter.dll (Trojan.DNSChanger) -> Delete on reboot.
C:\WINDOWS\nlmark2.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\autorun.inf (SuspectAutorun.Rootdrive.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds1.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds2.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds3.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\010112010146116101.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465050.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465249.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465349.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465354.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465549.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\mmsmark2.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2
25/09/2009 15:40:00
mbam-log-2009-09-25 (15-39-46).txt
Scan type: Full Scan (C:\|)
Objects scanned: 251301
Time elapsed: 48 minute(s), 32 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 76
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\program files\ddnsfilter\ddnsfilter.dll (Trojan.DNSChanger) -> No action taken.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ddnsfilter (Trojan.DNSChanger) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ddnsfilter (Trojan.DNSChanger) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddnsfilter (Trojan.DNSChanger) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> No action taken.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\ddnsfilter (Trojan.DNSChanger) -> No action taken.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.
Folders Infected:
C:\Program Files\DDnsFilter (Trojan.DNSChanger) -> No action taken.
Files Infected:
C:\1utbfd.bat (Spyware.OnlineGames) -> No action taken.
C:\22yj2fy1.exe (Worm.AutoRun) -> No action taken.
C:\6rxt26.exe (Worm.Magania) -> No action taken.
C:\hx.exe (Spyware.OnlineGames) -> No action taken.
C:\kgji.exe (Worm.Magania) -> No action taken.
C:\lcw.exe (Spyware.OnlineGames) -> No action taken.
C:\m1eqos3.exe (Worm.Magania) -> No action taken.
C:\mb9x.exe (Worm.Magania) -> No action taken.
C:\rx.exe (Worm.Magania) -> No action taken.
C:\u0riu2.exe (Spyware.OnlineGames) -> No action taken.
C:\ukfbi3aw.exe (Worm.Magania) -> No action taken.
C:\nkbd1v.exe (Spyware.OnlineGames) -> No action taken.
C:\p0ijj.bat (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091286.bat (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091293.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092287.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092327.dll (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092329.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092333.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092334.dll (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092401.dll (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092481.bat (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092546.dll (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092892.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092736.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092810.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0092954.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0093036.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093142.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093203.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093443.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093297.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093373.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093460.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093488.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP410\A0095220.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095231.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095663.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0095987.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096206.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096105.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0096285.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097361.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097477.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097568.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097663.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097761.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097851.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097908.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP418\A0098044.exe (Worm.Magania) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP419\A0098452.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098459.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098576.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098682.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098765.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098851.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\hippy14.exe (Worm.Koobface) -> No action taken.
C:\Program Files\DDnsFilter\DDnsFilter.dll (Trojan.DNSChanger) -> No action taken.
C:\WINDOWS\nlmark2.dat (KoobFace.Trace) -> No action taken.
C:\autorun.inf (SuspectAutorun.Rootdrive.H) -> No action taken.
C:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds1.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds2.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds3.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Camille\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\010112010146116101.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465050.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465249.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465349.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465354.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\0101120101465549.xe (KoobFace.Trace) -> No action taken.
C:\WINDOWS\mmsmark2.dat (KoobFace.Trace) -> No action taken.
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2
25/09/2009 15:40:27
mbam-log-2009-09-25 (15-40-27).txt
Scan type: Full Scan (C:\|)
Objects scanned: 251301
Time elapsed: 48 minute(s), 32 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 76
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\program files\ddnsfilter\ddnsfilter.dll (Trojan.DNSChanger) -> Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Folders Infected:
C:\Program Files\DDnsFilter (Trojan.DNSChanger) -> Delete on reboot.
Files Infected:
C:\1utbfd.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\22yj2fy1.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\6rxt26.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\hx.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\kgji.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\lcw.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\m1eqos3.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\mb9x.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\rx.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\u0riu2.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\ukfbi3aw.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\nkbd1v.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\p0ijj.bat (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091286.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0091293.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092287.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092327.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092329.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092333.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092334.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP404\A0092401.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092481.bat (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092546.dll (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092892.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092736.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP405\A0092810.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0092954.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP406\A0093036.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093142.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093203.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093443.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093297.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP407\A0093373.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093460.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP408\A0093488.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP410\A0095220.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095231.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP411\A0095663.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0095987.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096206.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP414\A0096105.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0096285.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097361.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP415\A0097477.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097568.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097663.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP416\A0097761.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097851.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP417\A0097908.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP418\A0098044.exe (Worm.Magania) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP419\A0098452.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098459.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098576.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP420\A0098682.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098765.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP421\A0098851.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\hippy14.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:\Program Files\DDnsFilter\DDnsFilter.dll (Trojan.DNSChanger) -> Delete on reboot.
C:\WINDOWS\nlmark2.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\autorun.inf (SuspectAutorun.Rootdrive.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Local Settings\Temp\cvasds1.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds2.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\cvasds3.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Camille\Local Settings\Temp\herss.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\010112010146116101.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465050.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465249.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465349.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465354.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101465549.xe (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\mmsmark2.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
Ok. Fais ceci stp :
SmitfraudFix :
Option 1 - Recherche :
▶ Télécharge Smitfraudfix et enregistre le sur le bureau
▶ Sous XP : Double clique sur smitfraudfix puis exécuter
▶ Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
(attention : N utilise pas l'option 2 si je ne te l'ai pas demandé !!)
▶ Copie/colle le rapport dans la réponse.
Voici un tutoriel sonore et animé en cas de problème d'utilisation
(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)
++
SmitfraudFix :
Option 1 - Recherche :
▶ Télécharge Smitfraudfix et enregistre le sur le bureau
▶ Sous XP : Double clique sur smitfraudfix puis exécuter
▶ Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
(attention : N utilise pas l'option 2 si je ne te l'ai pas demandé !!)
▶ Copie/colle le rapport dans la réponse.
Voici un tutoriel sonore et animé en cas de problème d'utilisation
(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)
++
wadcox
Messages postés
998
Date d'inscription
dimanche 16 juillet 2006
Statut
Membre
Dernière intervention
22 septembre 2011
222
25 sept. 2009 à 16:40
25 sept. 2009 à 16:40
re,
voici le rapport :
SmitFraudFix v2.424
Rapport fait à 16:33:55,26, 25/09/2009
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe
C:\Program Files\CA\eTrustITM\InoRpc.exe
C:\Program Files\CA\eTrustITM\InoRT.exe
C:\Program Files\CA\eTrustITM\InoTask.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Program Files\Rainbow Technologies\SentinelLM 7.2.0 Server\English\lservnt.exe
C:\Program Files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\SMINST\Scheduler.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\CA\eTrustITM\realmon.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
»»»»»»»»»»»»»»»»»»»»»»»» RK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.200
HKLM\SYSTEM\CCS\Services\Tcpip\..\{92C97CA7-D6AB-4393-8BC8-0AA84597256E}: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS1\Services\Tcpip\..\{92C97CA7-D6AB-4393-8BC8-0AA84597256E}: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS3\Services\Tcpip\..\{92C97CA7-D6AB-4393-8BC8-0AA84597256E}: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.2
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
voici le rapport :
SmitFraudFix v2.424
Rapport fait à 16:33:55,26, 25/09/2009
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe
C:\Program Files\CA\eTrustITM\InoRpc.exe
C:\Program Files\CA\eTrustITM\InoRT.exe
C:\Program Files\CA\eTrustITM\InoTask.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Program Files\Rainbow Technologies\SentinelLM 7.2.0 Server\English\lservnt.exe
C:\Program Files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\SMINST\Scheduler.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\CA\eTrustITM\realmon.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
»»»»»»»»»»»»»»»»»»»»»»»» RK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.200
HKLM\SYSTEM\CCS\Services\Tcpip\..\{92C97CA7-D6AB-4393-8BC8-0AA84597256E}: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS1\Services\Tcpip\..\{92C97CA7-D6AB-4393-8BC8-0AA84597256E}: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS3\Services\Tcpip\..\{92C97CA7-D6AB-4393-8BC8-0AA84597256E}: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.200
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.2
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Tes recherches sont toujours redirigées ?
Habituellement, les détournements DNS sont accompagnés de Rootkit. Afin d'éviter une ré-infection sous peu et pour parer à cela, fais ce qui suit :
/!\ A l'attention de ceux qui passent sur ce sujet : L'outil qui suit ne doit pas être utilisé sans avis /!\
/!\ Désactive tes protections résidentes (Antivirus, Antispywares, etc...) /!\
Télécharge ComboFix (de sUBs) sur ton Bureau.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
* Il va te demander d'installer la console de récupération : ACCEPTE !.
* Ne touche pas au pc durant le scan.
* Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un Tutoriel sur l'utilisation de ComboFix (à lire avant de le lancer)
-->> https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
++
Habituellement, les détournements DNS sont accompagnés de Rootkit. Afin d'éviter une ré-infection sous peu et pour parer à cela, fais ce qui suit :
/!\ A l'attention de ceux qui passent sur ce sujet : L'outil qui suit ne doit pas être utilisé sans avis /!\
/!\ Désactive tes protections résidentes (Antivirus, Antispywares, etc...) /!\
Télécharge ComboFix (de sUBs) sur ton Bureau.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
* Il va te demander d'installer la console de récupération : ACCEPTE !.
* Ne touche pas au pc durant le scan.
* Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un Tutoriel sur l'utilisation de ComboFix (à lire avant de le lancer)
-->> https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
++