trojan dans mon windows/système32/send.exe

Question

Bonjour,je poste ici pour avoir des information sur le virus que j'ai attrapé . Je sais où se trouve le fichier mais pour le suprimer il faut que je l'éxécute en tant qu'admistrateur et donc quand j'essaye de l'éxécuter en tant qu'administrateur , celà me dit "Vous n'avez pas l'autorisation d'afficher ou de modifier les paramètres d'autorisation actuels de cette objet " . Merci à vous de m'aider pour mon problème.

truecode · Answer

Bonjour,

Commence par faire cela :

&#9679; Télécharge ici : 

http://images.malwareremoval.com/random/RSIT.exe 

random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau. 

&#9679; Double-clique sur RSIT.exe afin de lancer RSIT. 

&#9679; Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions). 

&#9679; Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

&#9679; Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

&#9679; Poste le contenu de log.txt

edwinewilan · Answer

euh non c'est marqué "non valide"

edwinewilan · Answer

ah si c bon sa marche

truecode · Answer

D'accord j'attend le rapport je vais manger et je regarde dès que j'ai fini

edwinewilan · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Isabelle at 2010-01-29 20:30:40
Microsoft® Windows Vista™ Édition Familiale Premium  
System drive C: has 42 GB (29%) free of 145 GB
Total RAM: 2046 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:30:43, on 29/01/2010
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\System32\ServoApp.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Windows\System32undll32.exe
C:\Program Files\WindowsSecurity\SystemR1.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Orange\Media Player\Media Player.exe
C:\Users\Isabelle\Documents\Mes fichiers reçus\Steam.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\WindowsSecurity\Systemx32.exe
C:\Program Files\WindowsSecurity\SystemR2.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Isabelle\Desktop\RSIT.exe
C:\Program Files	rend micro\Isabelle.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yoower.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [MFP Manager] C:\Program Files\MFP Server\MFPAgent.exe -CheckAutoRun
O4 - HKLM\..\Run: [Server Application] C:\Windows\system32\ServoApp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_SB56.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [OrangePlayer] C:\Program Files\Orange\Media Player\Media Player.exe /systray
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Steam] "c:\users\isabelle\documents\mes fichiers reçus\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [OrangePlayer] C:\Program Files\Orange\Media Player\Media Player.exe /systray (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [OrangePlayer] C:\Program Files\Orange\Media Player\Media Player.exe /systray (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OrangePlayer] C:\Program Files\Orange\Media Player\Media Player.exe /systray (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: Service Google Update (gupdate1ca5409221adc3c) (gupdate1ca5409221adc3c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

edwinewilan · Answer

voila se que sa me met

truecode · Answer

Télécharge OTM 
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/ (de Old_Timer) sur ton Bureau.

double-clique sur OTM.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.
(attention bien mettre :files)

:files
C:\Program Files\WindowsSecurity\SystemR1.exe
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTM\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

__________________________

colle un nouveau  rapport avec RSIT

edwinewilan · Answer

j'ai pas bien compris il faut que j'écrive sa en plus ":files 
C:\Program Files\WindowsSecurity\SystemR1.exe 
:commands 
[purity] 
[emptytemp] 
[start explorer 


?

edwinewilan · Answer

Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <--> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <======Scheduled tasks folder======> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <======Registry dump======> in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]> in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]> in the current context! Error: Unable to interpret <{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll [2007-01-12 607888]> in the current context! Error: Unable to interpret <{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-29 279664]> in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]> in the current context! Error: Unable to interpret <"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-03-02 1006264]> in the current context! Error: Unable to interpret <"SMSERIAL"=C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2007-01-16 634880]> in the current context! Error: Unable to interpret <"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-01-13 827392]> in the current context! Error: Unable to interpret <"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-09 4390912]> in the current context! Error: Unable to interpret <"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2008-12-04 186904]> in the current context! Error: Unable to interpret <"ccApp"=c:\Program Files\Common Files\Symantec Shared\ccApp.exe [2007-01-10 115816]> in the current context! Error: Unable to interpret <"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2007-04-23 176128]> in the current context! Error: Unable to interpret <"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-12-06 202032]> in the current context! Error: Unable to interpret <"HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-03-12 50696]> in the current context! Error: Unable to interpret <"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]> in the current context! Error: Unable to interpret <"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-10 317128]> in the current context! Error: Unable to interpret <"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]> in the current context! Error: Unable to interpret <"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-18 266497]> in the current context! Error: Unable to interpret <"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]> in the current context! Error: Unable to interpret <"MFP Manager"=C:\Program Files\MFP Server\MFPAgent.exe -CheckAutoRun []> in the current context! Error: Unable to interpret <"Server Application"=C:\Windows\system32\ServoApp.exe [2008-05-16 417792]> in the current context! Error: Unable to interpret <"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]> in the current context! Error: Unable to interpret <"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576]> in the current context! Error: Unable to interpret <""= []> in the current context! Error: Unable to interpret <"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-04 13556256]> in the current context! Error: Unable to interpret <"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-12-04 92704]> in the current context! Error: Unable to interpret <"Systemx32"=C:\Program Files\WindowsSecurity\SystemR1.exe [2009-06-17 332923]> in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]> in the current context! Error: Unable to interpret <"Launcher"=C:\Windows\SMINST\launcher.exe [2006-11-07 44128]> in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]> in the current context! Error: Unable to interpret <"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-03-02 1232896]> in the current context! Error: Unable to interpret <"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]> in the current context! Error: Unable to interpret <"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2006-07-14 20034600]> in the current context! Error: Unable to interpret <"msnmsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2009-07-26 3883856]> in the current context! Error: Unable to interpret <"EPSON Stylus DX7400 Series"=C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE [2007-04-12 182272]> in the current context! Error: Unable to interpret <"OrangePlayer"=C:\Program Files\Orange\Media Player\Media Player.exe [2009-02-16 319488]> in the current context! Error: Unable to interpret <"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-06-18 39408]> in the current context! Error: Unable to interpret <"Steam"=c:\users\isabelle\documents\mes fichiers reçus\steam.exe [2010-01-08 1217808]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]> in the current context! Error: Unable to interpret <"EnableLUA"=0> in the current context! Error: Unable to interpret <"dontdisplaylastusername"=0> in the current context! Error: Unable to interpret <"legalnoticecaption"=> in the current context! Error: Unable to interpret <"legalnoticetext"=> in the current context! Error: Unable to interpret <"shutdownwithoutlogon"=1> in the current context! Error: Unable to interpret <"undockwithoutlogon"=1> in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]> in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]> in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11e94517-db6f-11de-be75-001b24bb76a9}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6167430c-f460-11de-9081-001b24bb76a9}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87515315-ec6d-11dc-bd10-001b24bb76a9}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d37cdb5b-c221-11de-8c5d-001b24bb76a9}]> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <======List of files/folders created in the last 1 months======> in the current context! Error: Unable to interpret <2010-01-29 20:48:49 ----D---- C:\_OTM> in the current context! Error: Unable to interpret <2010-01-29 20:23:49 ----D---- C:\Program Files rend micro> in the current context! Error: Unable to interpret <2010-01-29 20:23:48 ----D---- C: sit> in the current context! Error: Unable to interpret <2010-01-29 17:52:36 ----A---- C:\Windows\system32\Send.exe> in the current context! Error: Unable to interpret <2010-01-28 13:28:41 ----A---- C:\ARK6A58.tmp> in the current context! Error: Unable to interpret <2010-01-22 17:29:24 ----A---- C:\Windows\system32\mshtml.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:22 ----A---- C:\Windows\system32\wininet.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:22 ----A---- C:\Windows\system32\urlmon.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:21 ----A---- C:\Windows\system32\ieframe.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:19 ----A---- C:\Windows\system32\mstime.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:18 ----A---- C:\Windows\system32\ieapfltr.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:17 ----A---- C:\Windows\system32\iedkcs32.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:16 ----A---- C:\Windows\system32\occache.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:16 ----A---- C:\Windows\system32\mshtmled.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:16 ----A---- C:\Windows\system32\msfeeds.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:16 ----A---- C:\Windows\system32\iertutil.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:16 ----A---- C:\Windows\system32\ieaksie.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:16 ----A---- C:\Windows\system32\icardie.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:16 ----A---- C:\Windows\system32\dxtmsft.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:15 ----A---- C:\Windows\system32\jsproxy.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:15 ----A---- C:\Windows\system32\ieencode.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:15 ----A---- C:\Windows\system32\dxtrans.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\pngfilt.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\ieUnatt.exe> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\ieui.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\iesetup.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\iernonce.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\ie4uinit.exe> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\advpack.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:14 ----A---- C:\Windows\system32\admparse.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:13 ----A---- C:\Windows\system32\mshtmler.dll> in the current context! Error: Unable to interpret <2010-01-22 17:29:13 ----A---- C:\Windows\system32\ieakui.dll> in the current context! Error: Unable to interpret <2010-01-17 12:05:03 ----D---- C:\Program Files\WindowsSecurity> in the current context! Error: Unable to interpret <2010-01-16 20:31:01 ----D---- C:\Users\Isabelle\AppData\Roaming\Audacity> in the current context! Error: Unable to interpret <2010-01-16 20:30:37 ----D---- C:\Program Files\Audacity 1.3 Beta (Unicode)> in the current context! Error: Unable to interpret <2010-01-15 17:43:26 ----A---- C:\Windows\system32 2embed.dll> in the current context! Error: Unable to interpret <2010-01-15 17:43:26 ----A---- C:\Windows\system32\lpk.dll> in the current context! Error: Unable to interpret <2010-01-15 17:43:26 ----A---- C:\Windows\system32\fontsub.dll> in the current context! Error: Unable to interpret <2010-01-15 17:43:26 ----A---- C:\Windows\system32\dciman32.dll> in the current context! Error: Unable to interpret <2010-01-15 17:43:26 ----A---- C:\Windows\system32\atmlib.dll> in the current context! Error: Unable to interpret <2010-01-15 17:43:26 ----A---- C:\Windows\system32\atmfd.dll> in the current context! Error: Unable to interpret <2010-01-11 19:40:39 ----A---- C:\Windows\ChssBase.ini> in the current context! Error: Unable to interpret <2010-01-08 18:50:28 ----D---- C:\Program Files\Common Files\Steam> in the current context! Error: Unable to interpret <======List of files/folders modified in the last 1 months======> in the current context! Error: Unable to interpret <2010-01-29 20:51:02 ----D---- C:\Windows\Temp> in the current context! Error: Unable to interpret <2010-01-29 20:23:49 ----RD---- C:\Program Files> in the current context! Error: Unable to interpret <2010-01-29 17:52:36 ----D---- C:\Windows\System32> in the current context! Error: Unable to interpret <2010-01-29 17:51:12 ----D---- C:\Windows\Prefetch> in the current context! Error: Unable to interpret <2010-01-29 17:44:59 ----SHD---- C:\System Volume Information> in the current context! Error: Unable to interpret <2010-01-29 17:34:36 ----D---- C:\Users\Isabelle\AppData\Roaming\Skype> in the current context! Error: Unable to interpret <2010-01-29 17:32:04 ----SHD---- C:\Windows\Installer> in the current context! Error: Unable to interpret <2010-01-29 17:20:54 ----D---- C:\Users\Isabelle\AppData\Roaming\Media Player> in the current context! Error: Unable to interpret <2010-01-29 17:19:21 ----D---- C:\Windows\SMINST> in the current context! Error: Unable to interpret <2010-01-24 18:35:54 ----D---- C:\Windows\system32\migration> in the current context! Error: Unable to interpret <2010-01-24 18:35:54 ----D---- C:\Program Files\Internet Explorer> in the current context! Error: Unable to interpret <2010-01-24 18:35:53 ----D---- C:\Windows\AppPatch> in the current context! Error: Unable to interpret <2010-01-24 18:31:30 ----D---- C:\Windows\winsxs> in the current context! Error: Unable to interpret <2010-01-22 17:25:54 ----D---- C:\Windows\system32\catroot2> in the current context! Error: Unable to interpret <2010-01-22 17:25:54 ----D---- C:\Windows\system32\catroot> in the current context! Error: Unable to interpret <2010-01-16 10:20:42 ----D---- C:\Program Files\Windows Mail> in the current context! Error: Unable to interpret <2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe> in the current context! Error: Unable to interpret <2010-01-11 19:40:49 ----D---- C:\Users\Isabelle\AppData\Roaming\ChessBase> in the current context! Error: Unable to interpret <2010-01-11 19:40:39 ----D---- C:\Windows> in the current context! Error: Unable to interpret <2010-01-08 18:50:28 ----D---- C:\Program Files\Common Files> in the current context! Error: Unable to interpret <2010-01-08 18:13:00 ----D---- C:\Windows\inf> in the current context! Error: Unable to interpret <2010-01-08 18:13:00 ----A---- C:\Windows\system32\PerfStringBackup.INI> in the current context! Error: Unable to interpret <2010-01-08 18:06:37 ----A---- C:\Windows\HideWin.exe> in the current context! Error: Unable to interpret <2010-01-05 01:17:46 ----A---- C:\Windows\system32\mrt.exe> in the current context! Error: Unable to interpret <2010-01-01 22:44:18 ----D---- C:\Users\Isabelle\AppData\Roaming\WinRAR> in the current context! Error: Unable to interpret <2009-12-30 23:12:07 ----D---- C:\Windows\Minidump> in the current context! Error: Unable to interpret <======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <-----------------EOF-----------------> in the current context! OTM by OldTimer - Version 3.1.7.0 log created on 01292010_205246

edwinewilan · Answer

Voila se que j'ai maintenent

truecode · Answer

Tu fais un copier coller de ca dans OTM.exe

:files
C:\Program Files\WindowsSecurity\SystemR1.exe
:commands
[purity]
[emptytemp]
[start explorer] 

Ensuite tu clique MoveIt!
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTM\MovedFiles.

edwinewilan · Answer

c'est bon le virus est détruit encore merci merci beaucoup pour ton aide préscieuse a bientot

truecode · Answer

Si tu pense que c'est bon tu peux mettre résolu.
Sinon on peut toujours finir la vérification en me postant le nouveau rapport RSIT tu peux l'héberger sur http://www.cijoint.fr/

jacques.gache · Answer

nathan bonjour, j'aimerais bien savoir si edwinewilan  sont bien les même personne ???

car vu la désinfection proposer par truecode  je doute de sont efficassité et j'aimerais bien un nouveau log.txt pour faire le point car perso je vois des choses qui n'ont pas été supprimé   

truecode ne prend pas brimade de cela , moi aussi j'ai commencer par des erreurs de lecture !!

edwinewilan · Answer

oui je suis nathan mais c'est parce que g changer de pseudo mais sinon c'est bon je n'ai plus le virus merci quand meme .

jacques.gache · Answer

ok si tu me dis pluis de virus moi je voudrais bien te croire mais perso je crois plus les rapports et dans RSIT je vois [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] 
shell\AutoRun\command - G:\LaunchU3.exe -a 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11e94517-db6f-11de-be75-001b24bb76a9}] 
shell\AutoRun\command - cqb6wo.exe 
shell\open\command - cqb6wo.exe 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6167430c-f460-11de-9081-001b24bb76a9}] 
shell\Auto\command - F:\launcher.exe 
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\launcher.exe 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87515315-ec6d-11dc-bd10-001b24bb76a9}] 
shell\AutoRun\command - G:\LaunchU3.exe -a 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d37cdb5b-c221-11de-8c5d-001b24bb76a9}] 
shell\Auto\command - F:\launcher.exe 
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\launcher.exe 



 et je n'ai pas vu de rapport d'outils qui aurai supprimé cela ???  

MAIS BON C EST TON PC SI TU DIS QUE PLUS DE PROBLEMES  ET BIEN JE TE DIS A BIENTOT SUR  CCM

truecode · Answer

Bonsoir Jacques.gache , je ne le prend pas mal loin de là mais bon il arrive que certaines fois des membres ne voyant plus de soucis ne reviennent pu sur le poste. C'est bien pour cela que j'avais demander le nouveau rapport RSIT pour repartir sur une analyse du log . ( il est vrai que j'aurais pu le voir avant mais bon )

Il faudrais utiliser USB Fix pour supprimer ces lignes

 * Télécharge UsbFix http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe (de Chiquitine29 & C_XX) sur ton Bureau.
    * Lance l'installation avec les paramètres par défaut.
    * Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
    * Double-clique sur le raccourci UsbFix sur ton Bureau.
    * Choisis l'option 1 (Recherche).
    * Laisse travailler l'outil.
    * Poste le rapport UsbFix.txt. 


Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

"Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

Trojan dans mon windows/système32/send.exe

17 réponses

Newsletters