Help : infectionTrojan.Agent.H Résolu/Fermé

Question

Bonjour,

Quelqu'un pourrait-il m'aider à me débarrasser de ce trojan qui persiste...J'ai lancé Malwarebytes voici le rapport :

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3729
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

12/02/2010 13:32:57
mbam-log-2010-02-12 (13-32-57).txt

Type de recherche: Examen rapide
Eléments examinés: 107526
Temps écoulé: 6 minute(s), 37 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\myeyoki (Trojan.Agent.H) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Malgré la demande suppression de l'élément, il est toujours la!!!
Que dois-je faire?
Merci d'avance.

Utilisateur anonyme · Answer

bonjour
Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

- http://images.malwareremoval.com/random/RSIT.exe

! Déconnecte toi et ferme toutes tes applications en cours !

* Double-clique sur RSIT.exe pour le lancer .
* Une première fenêtre s'ouvre avec en titre : Disclaimer of warranty .
* Devant l'option List files/folders created ... , tu choisis  2 months
* Clique ensuite sur Continue pour lancer l'analyse ...
* Laisse faire le scan et ne touche pas au PC ...
* Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).
* Héberge le contenu de log.txt (c'est celui qui apparait à l'écran), ainsi que de  info.txt ici.  
Clique sur parcourir
Une fois que tu as trouvé les rapports à héberger, clique sur ouvrir
Clique sur Cliquez ici pour déposer le fichier, puis donne le lien
qui apparait comme ceci http:/www.cijoint.fr/cjlink.php?file=cj200911/cijgAdC3Ch.txt

Note : les rapports seront en outre sauvegardés dans ce dossier C:\rsit

wig · Answer

oups...au bout de quelques secondes apres avoir lancé rsit une fenetre atoIt error s'ouvre...
line -1:
error : Subscript used with non-Array variable

Que dois- je faire?

wig · Answer

Voila c'est fait...
http://www.cijoint.fr/cjlink.php?file=cj201002/cijSXPSIU4.txt

wig · Answer

Oui parce que j'avais un rootkit gen, je crois l'avoir éradiquer mais impossible de me débarraser de ce trojan...myeyoki...je ne sais pas quoi faire.

Sous tes conseils, j'ai désinstallé avg...

Je ne peux donc rien faire?

wig · Answer

Voila voila...


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft® Windows Vista™ Edition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2130  @ 1.86GHz )
   BIOS : Ver 1.00PARTTBLv
   USER : Wig ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 090118-0] 4.8.1229 (Activated)
   Firewall  : ZoneAlarm Firewall 7.1.254.000 (Activated)
   C:\ (Local Disk) - NTFS - Total:141 Go (Free:0 Go)
   D:\ (Local Disk) - NTFS - Total:7 Go (Free:2 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [1] ( 12/02/2010|16:23 )

   [ UAC => 0 ]

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Users\Wig\AppData\Roaming\MICROS~1\Windows\Cookies\wig@crawler[2].txt
   C:\Users\Wig\AppData\Roaming\MICROS~1\Windows\Cookies\wig@dnl.crawler[1].txt
   C:\Users\Wig\AppData\Roaming\MICROS~1\Windows\Cookies\wig@ui.crawlersmileys[2].txt
   C:\Program Files\DAEMON Tools Toolbar
   C:\Windows\Prefetch\CT4SKYPEPLUGIN20_MULTI_MEDIA.-C1514F62.pf
   C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://fr.ask.com/?o=15161&l=dis"
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF"
   "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
   "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
   "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
   "SearchAssistant"="http://toolbar.inbox.com/search/ie.aspx?tbid=160284"
   "CustomizeSearch"="http://toolbar.inbox.com/help/sa_customize.aspx?tbid=160284"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\Wig\AppData\Roaming\Microsoft\Windows\Recent\(100% tested - works with all versions) money ace crack.lnk
   C:\Users\Wig\Music\The Moldy Peaches - The Moldy Peaches\13 - Who's Got The Crack.mp3
   C:\PROGRA~2\Fugazo\Cooking Academy\cached\sounds\eggcrack.wav


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 12/02/2010|16:23 - Option : [1]

   -----------\  Fin du rapport a 16:23:49,40

wig · Answer

merci :)

je viens de lancer la suppression....je te poste le rapport...


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft® Windows Vista™ Edition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2130  @ 1.86GHz )
   BIOS : Ver 1.00PARTTBLv
   USER : Wig ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 090118-0] 4.8.1229 (Activated)
   Firewall  : ZoneAlarm Firewall 7.1.254.000 (Activated)
   C:\ (Local Disk) - NTFS - Total:141 Go (Free:0 Go)
   D:\ (Local Disk) - NTFS - Total:7 Go (Free:2 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [2] ( 12/02/2010|16:37 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\Users\Wig\AppData\Roaming\MICROS~1\Windows\Cookies\wig@crawler[2].txt
   Supprime! - C:\Users\Wig\AppData\Roaming\MICROS~1\Windows\Cookies\wig@dnl.crawler[1].txt
   Supprime! - C:\Users\Wig\AppData\Roaming\MICROS~1\Windows\Cookies\wig@ui.crawlersmileys[2].txt
   Supprime! - C:\Windows\Prefetch\CT4SKYPEPLUGIN20_MULTI_MEDIA.-C1514F62.pf
   Supprime! - C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
   Supprime! - C:\Program Files\DAEMON Tools Toolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://fr.ask.com/?o=15161&l=dis"
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "SearchAssistant"="http://toolbar.inbox.com/search/ie.aspx?tbid=160284"
   "CustomizeSearch"="http://toolbar.inbox.com/help/sa_customize.aspx?tbid=160284"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\Wig\Music\The Moldy Peaches - The Moldy Peaches\13 - Who's Got The Crack.mp3
   C:\PROGRA~2\Fugazo\Cooking Academy\cached\sounds\eggcrack.wav


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 12/02/2010|16:23 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 12/02/2010|16:38 - Option : [2]

   -----------\  Fin du rapport a 16:38:48,91

wig · Answer

Et du coup, j'ai relancé malwarebytes...trojan toujours vivant!!!

wig · Answer

plus la? 

refait un scan avast...rootkit gen de nouveau décelé...grrrrrr

wig · Answer

chouette que tu sois la...
petit souci list&kill'em introuvable...le lien que tu m'as transmis n'est pas valide...j'ai fait un ptit tour sur internet...je ne l'ai pas trouvé...

wig · Answer

trouvé!!!

wig · Answer

Voici le rapport....merci beaucoup pour ton aide :) List'em by g3n-h@ckm@n 1.2.5.0 User : Wig (Administrateurs) Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30 Start at: 15:09:02 | 13/02/2010 Contact : https://forums.commentcamarche.net/forum/virus-securite-7 Genuine Intel(R) CPU T2130 @ 1.86GHz Microsoft® Windows Vista™ Edition Familiale Premium (6.0.6001 32-bit) # Service Pack 1 Internet Explorer 7.0.6001.18000 Windows Firewall Status : Disabled AV : avast! antivirus 4.8.1229 [VPS 090118-0] 4.8.1229 [ Enabled | Updated ] FW : ZoneAlarm Firewall[ Enabled ]7.1.254.000 C:\ -> Disque fixe local | 141,63 Go (1,07 Go free) | NTFS D:\ -> Disque fixe local | 7,42 Go (2,19 Go free) [HP_RECOVERY] | NTFS E:\ -> Disque CD-ROM F:\ -> Disque CD-ROM G:\ -> Disque fixe local | 149,01 Go (3,72 Go free) [IOMEGA_HDD] | FAT32 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Windows\system32\Dwm.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\Explorer.EXE C:\Windows\system32\WLANExt.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Hp\HP Software Update\hpwuschd2.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32 askeng.exe C:\Windows\system32\svchost.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\StickyPad\StickyPad.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\j2 Messenger 4.4\J2GDllCmd.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32 askeng.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\alg.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\WerCon.exe C:\Windows\system32\conime.exe C:\Program Files\Windows Live\Mail\wlmail.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\List_Kill'em\List_Kill'em.scr C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe \?\C:\Windows\system32\wbem\WMIADAP.EXE C:\Users\Wig\AppData\Local emp\D728.tmp\pv.exe ====================== Keys "Run" ====================== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background Sticky Pad REG_SZ C:\Program Files\StickyPad\StickyPad.exe WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe j2 4.4 REG_SZ "C:\Program Files\j2 Messenger 4.4\J2GDllCmd.exe" /R Skype REG_SZ "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe IgfxTray REG_SZ C:\Windows\system32\igfxtray.exe HotKeysCmds REG_SZ C:\Windows\system32\hkcmd.exe Persistence REG_SZ C:\Windows\system32\igfxpers.exe HP Software Update REG_SZ C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe QlbCtrl REG_EXPAND_SZ %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start HP Health Check Scheduler REG_SZ c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe hpWirelessAssistant REG_EXPAND_SZ %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe WAWifiMessage REG_EXPAND_SZ %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe Symantec PIF AlertEng REG_SZ "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe hpqSRMon REG_SZ C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe" SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe" Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" Adobe ARM REG_SZ "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] ===================== Other Keys ===================== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] ConsentPromptBehaviorAdmin REG_DWORD 2 (0x2) ConsentPromptBehaviorUser REG_DWORD 1 (0x1) EnableInstallerDetection REG_DWORD 1 (0x1) EnableLUA REG_DWORD 1 (0x1) EnableSecureUIAPaths REG_DWORD 1 (0x1) EnableVirtualization REG_DWORD 1 (0x1) PromptOnSecureDesktop REG_DWORD 1 (0x1) ValidateAdminCodeSignatures REG_DWORD 0 (0x0) dontdisplaylastusername REG_DWORD 0 (0x0) legalnoticecaption REG_SZ legalnoticetext REG_SZ scforceoption REG_DWORD 0 (0x0) shutdownwithoutlogon REG_DWORD 1 (0x1) undockwithoutlogon REG_DWORD 1 (0x1) FilterAdministratorToken REG_DWORD 1 (0x1) EnableUIADesktopToggle REG_DWORD 0 (0x0) DisableRegistryTools REG_DWORD 0 (0x0) =============== [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDrives REG_DWORD 0 (0x0) =============== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDrives REG_DWORD 0 (0x0) =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] =============== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] ReportBootOk REG_SZ 1 Shell REG_SZ Explorer.exe Userinit REG_SZ C:\Windows\system32\userinit.exe, VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl" AutoRestartShell REG_DWORD 1 (0x1) LegalNoticeCaption REG_SZ LegalNoticeText REG_SZ PowerdownAfterShutdown REG_SZ 0 ShutdownWithoutLogon REG_SZ 0 cachedlogonscount REG_SZ 10 forceunlocklogon REG_DWORD 0 (0x0) passwordexpirywarning REG_DWORD 14 (0xe) Background REG_SZ 0 0 0 DebugServerCommand REG_SZ no WinStationsDisabled REG_SZ 0 DisableCAD REG_DWORD 1 (0x1) scremoveoption REG_SZ 0 ShutdownFlags REG_DWORD 39 (0x27) SFCDisable REG_DWORD 0 (0x0) System REG_SZ =============== [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\igfxcui] =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ =============== [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] C:\Program Files\BitTorrent\bittorrent.exe REG_SZ C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] =============== ActivX controls =============== HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7} =============== HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08D93247-E992-1A40-58BE-D3AEA2BA9A1E} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{096E6809-BC3E-35F7-C4A2-26C745EDF801} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{41927698-8041-7B20-E682-27AC5998F6BA} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{665CE365-30E9-AAAA-8CF9-6D7F12FE6E27} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66836682-EA22-2EA7-01EB-16E2B5AEFFF7} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{AD3F6C8C-B75F-9E6B-9443-2085C361F70B} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E} ============== BHO : ====== [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{01EBDEB0-2141-4B72-AD69-6DF5E4C02C1b}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] ================ Internet Explorer : ================ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ https://www.msn.com/fr-fr/ [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ https://fr.ask.com/?o=15161&l=dis ======== Services ======== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] Ndisuio : 0x3 ( OK = 3 ) EapHost : 0x3 ( OK = 2 ) Wlansvc : 0x2 ( OK = 2 ) SharedAccess : 0x2 ( OK = 2 ) windefend : 0x2 ( OK = 2 ) wuauserv : 0x2 ( OK = 2 ) wscsvc : 0x2 ( OK = 2 ) ========= Atapi.sys ========= %%%% HASHDEEP-1.0 %%%% size,md5,sha256,filename ## Invoked from: C:\Users\Wig\AppData\Local emp\D728.tmp ## C:\> hashdeep C:\Windows\System32\Drivers\atapi.sys ## 21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\System32\Drivers\atapi.sys Sources ======= C:\Windows\ERDNT\cache\atapi.sys C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys C:\Windows\System32\drivers\atapi.sys C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys Référence : ========== Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C ======= Drive : ======= D‚fragmenteur de disque Windows Copyright (c) 2006 Microsoft Corp. Rapport d'analyse pour le volume C: Taille du volume = 142 Go Espace libre = 1.08 Go ?tendue d'espace libre la plus grande = 41 Mo Pourcentage de fragmentation des fichiers = 4 % Remarqueے: sur les volumes NTFS, les fragments de fichiers de plus de 64ےMo ne sont pas inclus dans les statistiques de fragmentation. Il n'est pas n‚cessaire de d‚fragmenter ce volume. ¤¤¤¤¤¤¤¤¤¤ Files/folders : Present !! : C:\ProgramData\Trymedia Present !! : C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js Present !! : C:\Windows\mbr.exe Present !! : C:\Windows\System32\drivers\etc\hosts.msn Present !! : C:\Windows\System32\x64 Present !! : C:\Users\Wig\AppData\Roaming\E4D0.tmp Present !! : C:\Users\Wig\LOCAL Settings\Temp\DCA_privacy_FF.dat Present !! : C:\Users\Wig\LOCAL Settings\Temp\DCA_whitelist_FF.dat ¤¤¤¤¤¤¤¤¤¤ Keys : Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Present !! : HKEY_USERS\S-1-5-21-1140457731-771345777-4215484654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Present !! : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}" Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d} ============ catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-13 15:24:27 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "hdf12"=hex:fc,ea,af,2c,67,b0,2f,31,33,3a,41,63,83,cb,b5,93,1c,5f,25,ae,5b,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,7c,fb,64,18,8b,2e,ec,b1,94,1f,a9,d4,60,ce,89,26,92,.. "hdf12"=hex:8b,ca,d3,85,6c,55,e7,05,c7,8f,97,42,9f,74,99,dd,06,1d,cf,0b,85,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:c3,a3,8e,2b,48,89,98,c6,f8,43,22,af,d2,91,a7,7f,f6,55,e3,af,d0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "hdf12"=hex:fc,ea,af,2c,67,b0,2f,31,33,3a,41,63,83,cb,b5,93,1c,5f,25,ae,5b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,7c,fb,64,18,8b,2e,ec,b1,94,1f,a9,d4,60,ce,89,26,92,.. "hdf12"=hex:8b,ca,d3,85,6c,55,e7,05,c7,8f,97,42,9f,74,99,dd,06,1d,cf,0b,85,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:c3,a3,8e,2b,48,89,98,c6,f8,43,22,af,d2,91,a7,7f,f6,55,e3,af,d0,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x84E061F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\atapi -> 0x84e061f8 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ========== Programs ========== AceMoney Adobe adslTV Alawar AlexSoft Alwil Software AnglaisFacile.com ArabicSP Software ArabicWordMasterPro Atrise Audacity Backgammon 3D BankPerfect BitTorrent Bonjour Broadcom Brouf_Soft Canon CCleaner Common Files ComptaOne CONEXANT DAEMON Tools Lite desktop.ini Dictionnaire DivX Dream Day First Home DVD Shrink EasyBits Eidos Interactive Elaborate Bytes eMule Fichiers communs FileZilla FTP Client Free Internet TV GameHouse Google Grisoft Hewlett-Packard Hijackthis Version Fran‡aise Home Jukebox Hp HPQ Ihsv InstallShield Installation Information Internet Explorer iPod iTunes j2 Messenger 4.2 j2 Messenger 4.4 Java JRE LimeWire List_Kill'em Malwarebytes' Anti-Malware Marco Polo Fran‡ais-Anglais Thematic Micro Trivial Pursuit Microsoft Microsoft CAPICOM 2.1.0.2 Microsoft Games Microsoft Office Microsoft Silverlight Microsoft SQL Server Compact Edition Microsoft Sync Framework Microsoft Works MonDico Monopoly Movie Maker Mozilla Firefox Mozilla Thunderbird MSBuild MSXML 4.0 muvee Technologies Navilog1 Nodtronics OpenOffice.org 2.2 OpenOffice.org 3 OUIDIRE LookHere PamFax Passware Pidgin pidgin-otr QuickTime Real Real Alternative Reference Assemblies ReflexiveArcade Roxio ScrabBot ScreenCamera Selingua SelinguaColumns Sephonics Skype SLD Codec Pack Smart Projects SPF Spybot - Search & Destroy StickyPad Sun Symantec Synaptics The Rosetta Stone There Total PDF Converter Transparent trend micro TrueTerm PC TuneUp Utilities 2008 Ubisoft Uninstall Information Veoh Networks VideoLAN Winamp Windows Calendar Windows Collaboration Windows Defender Windows Journal Windows Live Windows Live SkyDrive Windows Mail Windows Media Player Windows NT Windows Photo Gallery Windows Sidebar WinRAR WordBiz Yahoo! Zattoo ZHPDiag Zylom Games ============ Drive C: ============ $RECYCLE.BIN 300_Icones autoexec.bat bcmwl6.log boot bootmgr cleannavi.txt ComboFix ComboFix.txt config.sys contactlist.xml Destinataire de PamFax.lnk Documents and Settings fixnavi.txt HP INSTALL.LOG IO.SYS Kill'em List'em.txt MSDOS.SYS My Documents pagefile.sys PDOXUSRS.NET PerfLogs Program Files ProgramData PRONOTE 2009 Qoobox rsit sqmdata00.sqm sqmdata01.sqm sqmdata02.sqm sqmdata03.sqm sqmdata04.sqm sqmdata05.sqm sqmdata06.sqm sqmdata07.sqm sqmnoopt00.sqm sqmnoopt01.sqm sqmnoopt02.sqm sqmnoopt03.sqm sqmnoopt04.sqm sqmnoopt05.sqm sqmnoopt06.sqm sqmnoopt07.sqm SwSetup System Volume Information System.sav TB.txt TB2.txt TELL ME MORE ARABIC ToolBar SD Users Windows YServer.txt _OTM ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials C:\SwSetup\MSWorks\FR\Install.exe ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ End of scan : 15:59:34,89

wig · Answer

Ah AH ca sent la fin!!!


Kill'em by g3n-h@ckm@n 1.2.5.0 
 
User : Wig (Administrateurs) 
Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30 
Start at: 16:09:59 | 13/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Genuine Intel(R) CPU           T2130  @ 1.86GHz
Microsoft® Windows Vista™ Edition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1229 [VPS 090118-0] 4.8.1229 [ Enabled | Updated ]
FW : ZoneAlarm Firewall[ Enabled ]7.1.254.000

C:\ -> Disque fixe local | 141,63 Go (1,07 Go free) | NTFS
D:\ -> Disque fixe local | 7,42 Go (2,19 Go free) [HP_RECOVERY] | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WLANExt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\StickyPad\StickyPad.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\j2 Messenger 4.4\J2GDllCmd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\alg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\WerCon.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Wig\AppData\Local	emp\C619.tmp\ERUNT.EXE
C:\Users\Wig\AppData\Local	emp\C619.tmp\pv.exe
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\ProgramData\Trymedia 
Quarantined & Deleted !! : C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js 
Quarantined & Deleted !! : C:\Windows\mbr.exe 
 
Quarantined & Deleted !! : C:\Windows\System32\drivers\etc\hosts.msn 
Quarantined & Deleted !! : C:\Windows\system32\x64 
Quarantined & Deleted !! : C:\Users\Wig\AppData\Roaming\E4D0.tmp 
Quarantined & Deleted !! : C:\Users\Wig\LOCAL Settings\Temp\DCA_privacy_FF.dat 
Quarantined & Deleted !! : C:\Users\Wig\LOCAL Settings\Temp\DCA_whitelist_FF.dat 
 
==============
host file OK !
==============

========
Registry
========

========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Wlansvc : Start = 2   
 SharedAccess : Start = 2   
 windefend : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

wig · Answer

la fin du virus!! j'ai relancé malwarebytes, il ne détecte plus de fichier infecté.
J'ai également relancé mon ordi...aucun problème au démarrage...

Une dernière étape?

wig · Answer

La fin du virus!! j'ai relancé malwarebytes, il ne détecte plus de fichiers infectés...
J'ai également redemarré mon ordi...aucun probleme non plus...

merci merci beaucoup pour ta patience et ta réactivité!!

Help : infectionTrojan.Agent.H

14 réponses

Newsletters