Trojan winad

sabi29 -  
 Siem -
salut,
je t'envoi mon test clCleanUp! started on 06/07/05 08:59:40.
C:\Documents and Settings\sabrina\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\sabrina\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\sabrina\Local Settings\Historique\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
'Typed URLs' (Internet Explorer) - removed from the registry.
C:\Documents and Settings\sabrina\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\sabrina\LOCALS~1\Temp\abm10.tmp - deleted
C:\DOCUME~1\sabrina\LOCALS~1\Temp\abm3B.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\sabrina\LOCALS~1\Temp\jusched.log - deleted
C:\DOCUME~1\sabrina\LOCALS~1\Temp\abm3B.tmp currently in use. Will be deleted when Windows is restarted.
C:\WINDOWS\temp\tmp000058af\tmp00000000 currently in use. Will be deleted when Windows is restarted.
C:\Program Files\Philips Photo Manager\FunCam\Philips Photo Manager.GID - deleted
C:\Documents and Settings\sabrina\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\sabrina\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\sabrina\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\sabrina\Local Settings\Temp\abm3B.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\sabrina\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\WINDOWS\Prefetch\5SPOTS2.EXE-0B7ABD36.pf - deleted
C:\WINDOWS\Prefetch\5_SPOTS.EXE-06687C55.pf - deleted
C:\WINDOWS\Prefetch\5_SPOTS.RWG-136E0A93.pf - deleted
C:\WINDOWS\Prefetch\AAWSEPERSONAL.EXE-0D393EC7.pf - deleted
C:\WINDOWS\Prefetch\AD-AWARE.EXE-0B387BE8.pf - deleted
C:\WINDOWS\Prefetch\AD-AWARE.EXE-2ED3360E.pf - deleted
C:\WINDOWS\Prefetch\ATI2MDXX.EXE-00F23993.pf - deleted
C:\WINDOWS\Prefetch\ATIPTAXX.EXE-0C0B8385.pf - deleted
C:\WINDOWS\Prefetch\A~NSISU_.EXE-35B5C172.pf - deleted
C:\WINDOWS\Prefetch\BDLITE.EXE-276162F2.pf - deleted
C:\WINDOWS\Prefetch\BDLITE.EXE-3553E76A.pf - deleted
C:\WINDOWS\Prefetch\BDMCON.EXE-378F7E33.pf - deleted
C:\WINDOWS\Prefetch\BDNAGENT.EXE-28DA6614.pf - deleted
C:\WINDOWS\Prefetch\BDNAGENT.EXE-3A2336E8.pf - deleted
C:\WINDOWS\Prefetch\BDNEWS.EXE-0467A177.pf - deleted
C:\WINDOWS\Prefetch\BDSS.EXE-00372D30.pf - deleted
C:\WINDOWS\Prefetch\BITDEFENDER_FREE_WIN_V72.EXE-33B66A38.pf - deleted
C:\WINDOWS\Prefetch\BITDEFENDER_FREE_WIN_V72.EXE-38DFF617.pf - deleted
C:\WINDOWS\Prefetch\BOB.EXE-364EAA43.pf - deleted
C:\WINDOWS\Prefetch\CLEANUP.EXE-3438663A.pf - deleted
C:\WINDOWS\Prefetch\CLEANUP312.EXE-18AE758A.pf - deleted
C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf - deleted
C:\WINDOWS\Prefetch\COLLAPSE.EXE-081C5D81.pf - deleted
C:\WINDOWS\Prefetch\CONFIG.EXE-0F72EF72.pf - deleted
C:\WINDOWS\Prefetch\CST.EXE-35E4C532.pf - deleted
C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf - deleted
C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf - deleted
C:\WINDOWS\Prefetch\DINERDASH.EXE-01FACCFF.pf - deleted
C:\WINDOWS\Prefetch\DISKCLEANER.EXE-21F6A797.pf - deleted
C:\WINDOWS\Prefetch\DIVX521XP2K.EXE-0D9A6DB8.pf - deleted
C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf - deleted
C:\WINDOWS\Prefetch\DWWIN.EXE-30875ADC.pf - deleted
C:\WINDOWS\Prefetch\EMULE.EXE-2A971BEB.pf - deleted
C:\WINDOWS\Prefetch\EN_BUBBLEFISHBOB_INST.EXE-0907934F.pf - deleted
C:\WINDOWS\Prefetch\EN_LUXOR_INST.EXE-08C30114.pf - deleted
C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf - deleted
C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf - deleted
C:\WINDOWS\Prefetch\GDIVX1.9.9.5.EXE-1D828BBD.pf - deleted
C:\WINDOWS\Prefetch\GLB1A2B.EXE-399F0321.pf - deleted
C:\WINDOWS\Prefetch\GOOGLETOOLBARINSTALLERXP2K_FR-03A25ADE.pf - deleted
C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf - deleted
C:\WINDOWS\Prefetch\HH.EXE-2D1A70B3.pf - deleted
C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf - deleted
C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf - deleted
C:\WINDOWS\Prefetch\INCD.EXE-0A3D304D.pf - deleted
C:\WINDOWS\Prefetch\INSC.TMP-16231CF6.pf - deleted
C:\WINDOWS\Prefetch\IRSETUP.EXE-176897D2.pf - deleted
C:\WINDOWS\Prefetch\IUN6002.EXE-04C3D7F2.pf - deleted
C:\WINDOWS\Prefetch\JNTVIEW.EXE-08D4EA4F.pf - deleted
C:\WINDOWS\Prefetch\JUSCHED.EXE-03DB2BA9.pf - deleted
C:\WINDOWS\Prefetch\Layout.ini - deleted
C:\WINDOWS\Prefetch\LOGAGENT.EXE-027AF92B.pf - deleted
C:\WINDOWS\Prefetch\LUXOR.EXE-39B1B826.pf - deleted
C:\WINDOWS\Prefetch\MAHJONG QUEST.EXE-294B5B11.pf - deleted
C:\WINDOWS\Prefetch\MAHJONG.EXE-279836B4.pf - deleted
C:\WINDOWS\Prefetch\MGG.EXE-1AB16170.pf - deleted
C:\WINDOWS\Prefetch\MG_S.EXE-01C62011.pf - deleted
C:\WINDOWS\Prefetch\MINI GOLF GOLD.EXE-2BA0EF78.pf - deleted
C:\WINDOWS\Prefetch\MMREGOCX.EXE-0FC9345F.pf - deleted
C:\WINDOWS\Prefetch\MPNOTIFY.EXE-3631A846.pf - deleted
C:\WINDOWS\Prefetch\MSHTA.EXE-331DF029.pf - deleted
C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf - deleted
C:\WINDOWS\Prefetch\MSIMN.EXE-38BA891D.pf - deleted
C:\WINDOWS\Prefetch\MSNMSGR.EXE-366A1A81.pf - deleted
C:\WINDOWS\Prefetch\MSWORKS.EXE-31812CA4.pf - deleted
C:\WINDOWS\Prefetch\NEROCHECK.EXE-092C6DFA.pf - deleted
C:\WINDOWS\Prefetch\NOTEPAD.EXE-189578DA.pf - deleted
C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf - deleted
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf - deleted
C:\WINDOWS\Prefetch\ONECLICKMAINTENANCE.EXE-21401E19.pf - deleted
C:\WINDOWS\Prefetch\PHILIPS PHOTO MANAGER.EXE-0E26E2ED.pf - deleted
C:\WINDOWS\Prefetch\PLLANGS.EXE-1BD8A4F3.pf - deleted
C:\WINDOWS\Prefetch\REALONEMESSAGECENTER.EXE-1B5B11B5.pf - deleted
C:\WINDOWS\Prefetch\REALPLAY.EXE-1BF219BD.pf - deleted
C:\WINDOWS\Prefetch\REALSCHED.EXE-04BEC5CC.pf - deleted
C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf - deleted
C:\WINDOWS\Prefetch\REGISTRYCLEANER.EXE-331DB938.pf - deleted
C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf - deleted
C:\WINDOWS\Prefetch\RELAPSE.EXE-186958D5.pf - deleted
C:\WINDOWS\Prefetch\RMX3.EXE-22F5483A.pf - deleted
C:\WINDOWS\Prefetch\RMXV3.EXE-00018C89.pf - deleted
C:\WINDOWS\Prefetch\RNARCADE.EXE-0482DFF8.pf - deleted
C:\WINDOWS\Prefetch\RNARCADE.EXE-0AE1C83A.pf - deleted
C:\WINDOWS\Prefetch\RPHELPERAPP.EXE-33CB172B.pf - deleted
C:\WINDOWS\Prefetch\RSVP.EXE-04E70CF3.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-120C4679.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-13022885.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-147710F4.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-179396CD.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-17B341D7.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-17FAD29B.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-22AD2B89.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-2576181F.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-29324511.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-293B8118.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-42ED87DE.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4489B61B.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-449D19B8.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf - deleted
C:\WINDOWS\Prefetch\SAVEUNINST.EXE-26066DD2.pf - deleted
C:\WINDOWS\Prefetch\SETUP.EXE-200E8825.pf - deleted
C:\WINDOWS\Prefetch\SOL.EXE-1C0C14EB.pf - deleted
C:\WINDOWS\Prefetch\SOUNDMAN.EXE-19745A34.pf - deleted
C:\WINDOWS\Prefetch\SXE13.TMP-1126E034.pf - deleted
C:\WINDOWS\Prefetch\SYSTEMOPTIMIZER.EXE-10C4678E.pf - deleted
C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf - deleted
C:\WINDOWS\Prefetch\TUMBLEBUGS.EXE-0AE5AE6A.pf - deleted
C:\WINDOWS\Prefetch\UNINS000.EXE-3B3872A7.pf - deleted
C:\WINDOWS\Prefetch\UNINSTALL.EXE-07664BE6.pf - deleted
C:\WINDOWS\Prefetch\UNINSTALL.EXE-141DBD56.pf - deleted
C:\WINDOWS\Prefetch\UNWISE.EXE-159A5BEC.pf - deleted
C:\WINDOWS\Prefetch\UPGREPL.EXE-13413F17.pf - deleted
C:\WINDOWS\Prefetch\USERINIT.EXE-30B18140.pf - deleted
C:\WINDOWS\Prefetch\VLOUNGE.EXE-25238166.pf - deleted
C:\WINDOWS\Prefetch\WINHLP32.EXE-2C18E975.pf - deleted
C:\WINDOWS\Prefetch\WINWORD.EXE-29F5CB89.pf - deleted
C:\WINDOWS\Prefetch\WISPTIS.EXE-0C21B942.pf - deleted
C:\WINDOWS\Prefetch\WKUFIND.EXE-355A3903.pf - deleted
C:\WINDOWS\Prefetch\WMFDIST.EXE-29CCE89F.pf - deleted
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf - deleted
C:\WINDOWS\Prefetch\WMPLAYER.EXE-18DDEF9D.pf - deleted
C:\WINDOWS\Prefetch\WMPLAYER.EXE-18DDEFA3.pf - deleted
C:\WINDOWS\Prefetch\WMPLAYER.EXE-18DDEFA4.pf - deleted
C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf - deleted
C:\WINDOWS\Prefetch\XCOMMSVR.EXE-184BD1FA.pf - deleted
C:\WINDOWS\Prefetch\ZUMA.EXE-2CF0787E.pf - deleted
C:\WINDOWS\Prefetch\_IU14D2N.TMP-18D4AC34.pf - deleted
'Run MRU' list - removed from the registry.
Paint Recent File List - removed from the registry.
Telnet's MRU list - removed from the registry.
CleanUp! recovered 4.8 MB of disk space from 130 files.
CleanUp! finished on 06/07/05 08:59:58.
ean up

6 réponses

  1.
    jean38 Messages postés 2534 Date d'inscription   Statut Contributeur Dernière intervention   47
     
    si dans un premier temps tu pouvais ecrire en fançais, çà nous eviterait à nous qui passons un grand nombre d'heures sur l'ecran de nous arracher les yeux pour lire le chinois.

    Jean
    1
    1. sabi29
       
      re,
      je voulai savoir comment virer le trojan winad que j'ai dans mon pc.je voulais savoir aussi comment remettre mon ordi au top car sur certaines page du net j'ai les lettres avec des accents qui n'apparaissent pas comme:éàèù.merci de m'aider.sab
      0
  2. jean38 Messages postés 2534 Date d'inscription   Statut Contributeur Dernière intervention   47
     
    Salut,

    clean up n'est pas un test mais il efface les fichiers Tmp et inutiles.
    Donc ton post ne sert à rien, que voulais tu??
    0
    1. sabi29
       
      salut,
      je voulai savoir komen virer un trojan winad.merci de me dire comment le virer et je voulai savoir aussi comment remettre mon ordi o top car sur certaines pages g les lettres comme éùèà ki n'apparaissent pas.en fait tou ce ki a un accent .merci de me depanner pour l'un ou l'autre voir les deux
      bisous
      0
  3. jean38 Messages postés 2534 Date d'inscription   Statut Contributeur Dernière intervention   47
     
    A j'ai tout compris, super.
    alors fait tout ce qui suit dans un premier temps.

    imprime les manip pour ne rien oublier.

    A/ si tu ne les as pas, telecharge:
    ad-aware et spyboot
    http://www.florensac-chasse-trap.com

    pointe ton curseur sur « section virus » sans cliquer
    click sur le menu qui apparaît et charge
    ad-aware et spyboot
    ainsi que CleanUp312.exe
    ne les utilise pas tout de suite

    idem si tu ne l’as pas A2 free sur http://www.emsisoft.net/fr/software/download/

    met à jour spybot, ad aware et a2 free sur internet (tu trouves l’option dans les menus) mais ne lance pas les scan.

    1) clic droit sur poste de travail
    propriété
    restauration systeme
    coche desactivé puis appliquer

    2) demarrer
    panneau de configuration
    outil
    option des dossiers
    affichage,
    coche afficher dossier cachés
    decoche : masquer extension des fichiers dont le type est connu
    masquer les fichiers protégés du systeme d'exploitation.

    3) demarre en mode sans echec.
    Soit tu tapotte sur la touche F8 alancement de Windows et tu choisi sans echec (pas d’inquiétude pour l’aspect de l’ecran)

    execute cleanup312.exe

    tu relances tes scan ad aware
    puis spy boot
    puis a2 free
    et vire tout ce qu'ils trouvent (c'est un peu long mais tu devrais t'en sortir).

    vide ta poubelle et redemarre en mode normal, c'est à dire avant de redemarrer, tu refais les manip de départ mais en recochant ... pour retrouver la config de départ.

    redemarre

    telecharge hijackthis:
    http://www.merijn.org/files/hijackthis.zip
    Dezippe le dans un dossier prévu a cet effet.
    Par exemple C:\hijackthis
    lance le puis:
    clic sur "do a system scan and save logfile" et pas autre chose
    fais un copier coller du log entier ici.

    A+

    Jean
    0
  4. manito12 Messages postés 55 Statut Membre 3
     
    Domage ,On a jamais su si ça avait marcher...Aussi, un petit merci ça fait pas mourrir.. loll
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Michok
     
    Bonjour, nous avons des problèmes sur notre réseau depuis ce matin et malgré nos recherches de soluces et de patchs sur les forums, on ne trouve pas de solution.
    Ce matin en connectant nos ordinateurs, nous avons eu un message d'erreur mettant en cause Issas.exe, or en faisant ces recherches nous avons découvert qu'il abritait une infection de type sasser.
    On a mis tous les patch possibles sans réussite.
    De plus nous avons découvert des backdoors dont un qui s'appelle wmplayer.exe .
    Sur mon ordi ils s'affichent en : WMPLAYER.EXE-18DDEF9D.pf ; WMPLAYER.EXE-18DDEFA1.pf, WMPLAYER.EXE-18DDEFA2.pf et se trouvent dans un répertoire nommé Preftech.

    Selon vous cela pourrait être une attaque virale? et si oui comment faire pour tout rétablir sans formater tous les disques durs de l'entreprise ?

    Merci d'avance
    0
  7. Siem
     
    WMPLAYER = window media player, ce lecteur est peut-être en train de télécharger des mises à jour ce qui ralentirait la connection.
    Mais je peux me tromper
    0

Discussions similaires

Aide pour un virus
cerise92700 -
MisteryBean -

41 réponses
Trojan impossible à supprimer!
Gridouu -
Malekal_morte- -

12 réponses
Comment supprimer le virus Trojan
vitsou -
vitsou -

18 réponses
Menace détectée TrojanSMS-PA sur Google Huawei/Android
Outmost -
bazfile -

6 réponses
Que pensez-vous de Trojan Remover ?
patmoss -
DOUBLON -

10 réponses