Destructio des virus
LCA
-
gen-hackman -
gen-hackman -
Bonjour,
comment m'y prendre pour detruire les virus recycler.exe et visualmedia.exe
voici les rapports que m'ont donné les utilitaires hijackthis et UsbFix
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:12:26, on 16/03/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\1109\VisualMedia.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\1109\VisualMedia.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinHTTrack\WinHTTrack.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\Prof\Bureau\tools\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [reg] C:\WINDOWS\system32\1109\VisualMedia.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [edit] C:\WINDOWS\system32\1109\VisualMedia.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{604B5F75-CED7-41A2-BCC1-F111F97F9F80}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ABB93E5E-C30B-4EBB-A22B-F9AA20089FEF}: NameServer = 41.204.94.237,195.24.194.177
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3F6A4B8-4726-4CE9-9F90-A9C87315EB5C}: NameServer = 81.199.3.7,81.199.0.36
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 5688 bytes
############################## | UsbFix V6.099 |
User : Prof (Administrateurs) # COEUR
Update on 11/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 10:32:41 | 16/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 15,93 Go (7,72 Go free) # NTFS
D:\ -> Disque fixe local # 58,59 Go (55,31 Go free) [donnee] # NTFS
F:\ -> Disque amovible # 1,93 Go (1,93 Go free) # FAT32
I:\ -> Disque CD-ROM
################## | Elements infectieux |
C:\Documents and Settings\Prof\autorun.inf
C:\WINDOWS\System32\autorun.inf
################## | Registre |
[HKLM\SOFTWARE\Classes\CLSID\MADOWN]
[HKCR\CLSID\MADOWN]
[HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]
[HKLM\SYSTEM\ControlSet001\Services\AVPsys]
[HKLM\SYSTEM\ControlSet003\Services\AVPsys]
[HKLM\software\microsoft\windows nt\currentversion\winlogon] "Taskman"
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{05f84d54-e5c4-11dc-bd03-00195b38c6a1}
Shell\AutoRun\command =E:\vfjc8mxm.exe
Shell\explore\Command =E:\vfjc8mxm.exe
Shell\open\Command =E:\vfjc8mxm.exe
HKCU\..\..\Explorer\MountPoints2\{06edd5b9-1d36-11df-807c-009027bb14a0}
Shell\AutoRun\command =E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\MsGv.exe
Shell\open\command =E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\MsGv.exe
HKCU\..\..\Explorer\MountPoints2\{0bc35952-229b-11df-8089-009027bb14a0}
Shell\AutoRun\command =folder.tmp/tmp.exe
Shell\explore\command =folder.tmp/tmp.exe
Shell\open\command =folder.tmp/tmp.exe
HKCU\..\..\Explorer\MountPoints2\{0ca28190-ea7b-11dc-bd0d-00195b38c6a1}
Shell\AutoRun\command =J:\8ng8w.com
Shell\explore\Command =J:\8ng8w.com
Shell\open\Command =J:\8ng8w.com
HKCU\..\..\Explorer\MountPoints2\{0d63e980-b1a7-11de-bfea-009027bb14a0}
Shell\AutoRun\command =ZABORAVI/nikada.exe
Shell\explore\command =ZABORAVI/nikada.exe
Shell\open\command =ZABORAVI/nikada.exe
HKCU\..\..\Explorer\MountPoints2\{17682695-e388-11dc-bcfd-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{299f31f3-5674-11de-bf42-009027bb14a0}
Shell\AutoRun\command =E:\memorybar.exe
HKCU\..\..\Explorer\MountPoints2\{34694a2c-8e19-11dd-be20-009027bb14a0}
Shell\AutoRun\command =E:\nfdmg.com
Shell\explore\Command =E:\nfdmg.com
Shell\open\Command =E:\nfdmg.com
HKCU\..\..\Explorer\MountPoints2\{36c11b44-3ae4-11dd-bd9b-00195b38c6a1}
Shell\AutoRun\command =J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
Shell\open\command =J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
HKCU\..\..\Explorer\MountPoints2\{3df408d9-e91c-11dc-bd07-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{4af2ee91-5c06-11de-bf4e-009027bb14a0}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =E:\log.exe
HKCU\..\..\Explorer\MountPoints2\{9eca6a72-5d52-11dd-bdd0-00192163db03}
Shell\Auto\command =auto.exe
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
Shell\Ouvrir\command =log.exe
HKCU\..\..\Explorer\MountPoints2\{abbd055a-346f-11dd-bd90-00195b38c6a1}
Shell\AutoRun\command =J:\LaunchU3.exe -a
HKCU\..\..\Explorer\MountPoints2\{abbd055b-346f-11dd-bd90-00195b38c6a1}
Shell\AutoRun\command =K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
Shell\open\command =K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
HKCU\..\..\Explorer\MountPoints2\{af1320dd-0534-11dd-bd3d-00195b38c6a1}
Shell\AutoRun\command =J:\q83iwmgf.bat
Shell\explore\Command =J:\q83iwmgf.bat
Shell\open\Command =J:\q83iwmgf.bat
HKCU\..\..\Explorer\MountPoints2\{bded4390-4999-11dd-bdbb-00195b38c6a1}
Shell\AutoRun\command =E:\RECYCLER\S-1-6-21-2438476501-1644491937-701003331-1213\WinMgmt.exe
Shell\open\command =E:\RECYCLER\S-1-6-21-2438476501-1644491937-701003331-1213\WinMgmt.exe
HKCU\..\..\Explorer\MountPoints2\{bf64acfc-5e31-11dd-bdd3-00192163db03}
Shell\AutoRun\command =J:\g2pfnid.com
Shell\explore\Command =J:\g2pfnid.com
Shell\open\Command =J:\g2pfnid.com
HKCU\..\..\Explorer\MountPoints2\{c10df426-ae00-11de-bfe5-009027bb14a0}
Shell\AutoRun\command =E:\folder.tmp/tmp.exe
Shell\explore\command =E:\folder.tmp/tmp.exe
Shell\open\command =E:\folder.tmp/tmp.exe
HKCU\..\..\Explorer\MountPoints2\{c1400634-ef31-11dc-bd17-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =log.exe
HKCU\..\..\Explorer\MountPoints2\{cb6b734e-dac6-11dc-bce8-00047699115c}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{eab50ba4-6233-11de-bf5b-009027bb14a0}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =E:\log.exe
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné !
################## | ! Fin du rapport # UsbFix V6.099 ! |
merci bien
comment m'y prendre pour detruire les virus recycler.exe et visualmedia.exe
voici les rapports que m'ont donné les utilitaires hijackthis et UsbFix
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:12:26, on 16/03/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\1109\VisualMedia.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\1109\VisualMedia.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinHTTrack\WinHTTrack.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\Prof\Bureau\tools\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [reg] C:\WINDOWS\system32\1109\VisualMedia.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [edit] C:\WINDOWS\system32\1109\VisualMedia.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{604B5F75-CED7-41A2-BCC1-F111F97F9F80}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ABB93E5E-C30B-4EBB-A22B-F9AA20089FEF}: NameServer = 41.204.94.237,195.24.194.177
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3F6A4B8-4726-4CE9-9F90-A9C87315EB5C}: NameServer = 81.199.3.7,81.199.0.36
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 5688 bytes
############################## | UsbFix V6.099 |
User : Prof (Administrateurs) # COEUR
Update on 11/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 10:32:41 | 16/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 15,93 Go (7,72 Go free) # NTFS
D:\ -> Disque fixe local # 58,59 Go (55,31 Go free) [donnee] # NTFS
F:\ -> Disque amovible # 1,93 Go (1,93 Go free) # FAT32
I:\ -> Disque CD-ROM
################## | Elements infectieux |
C:\Documents and Settings\Prof\autorun.inf
C:\WINDOWS\System32\autorun.inf
################## | Registre |
[HKLM\SOFTWARE\Classes\CLSID\MADOWN]
[HKCR\CLSID\MADOWN]
[HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]
[HKLM\SYSTEM\ControlSet001\Services\AVPsys]
[HKLM\SYSTEM\ControlSet003\Services\AVPsys]
[HKLM\software\microsoft\windows nt\currentversion\winlogon] "Taskman"
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{05f84d54-e5c4-11dc-bd03-00195b38c6a1}
Shell\AutoRun\command =E:\vfjc8mxm.exe
Shell\explore\Command =E:\vfjc8mxm.exe
Shell\open\Command =E:\vfjc8mxm.exe
HKCU\..\..\Explorer\MountPoints2\{06edd5b9-1d36-11df-807c-009027bb14a0}
Shell\AutoRun\command =E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\MsGv.exe
Shell\open\command =E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\MsGv.exe
HKCU\..\..\Explorer\MountPoints2\{0bc35952-229b-11df-8089-009027bb14a0}
Shell\AutoRun\command =folder.tmp/tmp.exe
Shell\explore\command =folder.tmp/tmp.exe
Shell\open\command =folder.tmp/tmp.exe
HKCU\..\..\Explorer\MountPoints2\{0ca28190-ea7b-11dc-bd0d-00195b38c6a1}
Shell\AutoRun\command =J:\8ng8w.com
Shell\explore\Command =J:\8ng8w.com
Shell\open\Command =J:\8ng8w.com
HKCU\..\..\Explorer\MountPoints2\{0d63e980-b1a7-11de-bfea-009027bb14a0}
Shell\AutoRun\command =ZABORAVI/nikada.exe
Shell\explore\command =ZABORAVI/nikada.exe
Shell\open\command =ZABORAVI/nikada.exe
HKCU\..\..\Explorer\MountPoints2\{17682695-e388-11dc-bcfd-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{299f31f3-5674-11de-bf42-009027bb14a0}
Shell\AutoRun\command =E:\memorybar.exe
HKCU\..\..\Explorer\MountPoints2\{34694a2c-8e19-11dd-be20-009027bb14a0}
Shell\AutoRun\command =E:\nfdmg.com
Shell\explore\Command =E:\nfdmg.com
Shell\open\Command =E:\nfdmg.com
HKCU\..\..\Explorer\MountPoints2\{36c11b44-3ae4-11dd-bd9b-00195b38c6a1}
Shell\AutoRun\command =J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
Shell\open\command =J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
HKCU\..\..\Explorer\MountPoints2\{3df408d9-e91c-11dc-bd07-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{4af2ee91-5c06-11de-bf4e-009027bb14a0}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =E:\log.exe
HKCU\..\..\Explorer\MountPoints2\{9eca6a72-5d52-11dd-bdd0-00192163db03}
Shell\Auto\command =auto.exe
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
Shell\Ouvrir\command =log.exe
HKCU\..\..\Explorer\MountPoints2\{abbd055a-346f-11dd-bd90-00195b38c6a1}
Shell\AutoRun\command =J:\LaunchU3.exe -a
HKCU\..\..\Explorer\MountPoints2\{abbd055b-346f-11dd-bd90-00195b38c6a1}
Shell\AutoRun\command =K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
Shell\open\command =K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
HKCU\..\..\Explorer\MountPoints2\{af1320dd-0534-11dd-bd3d-00195b38c6a1}
Shell\AutoRun\command =J:\q83iwmgf.bat
Shell\explore\Command =J:\q83iwmgf.bat
Shell\open\Command =J:\q83iwmgf.bat
HKCU\..\..\Explorer\MountPoints2\{bded4390-4999-11dd-bdbb-00195b38c6a1}
Shell\AutoRun\command =E:\RECYCLER\S-1-6-21-2438476501-1644491937-701003331-1213\WinMgmt.exe
Shell\open\command =E:\RECYCLER\S-1-6-21-2438476501-1644491937-701003331-1213\WinMgmt.exe
HKCU\..\..\Explorer\MountPoints2\{bf64acfc-5e31-11dd-bdd3-00192163db03}
Shell\AutoRun\command =J:\g2pfnid.com
Shell\explore\Command =J:\g2pfnid.com
Shell\open\Command =J:\g2pfnid.com
HKCU\..\..\Explorer\MountPoints2\{c10df426-ae00-11de-bfe5-009027bb14a0}
Shell\AutoRun\command =E:\folder.tmp/tmp.exe
Shell\explore\command =E:\folder.tmp/tmp.exe
Shell\open\command =E:\folder.tmp/tmp.exe
HKCU\..\..\Explorer\MountPoints2\{c1400634-ef31-11dc-bd17-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =log.exe
HKCU\..\..\Explorer\MountPoints2\{cb6b734e-dac6-11dc-bce8-00047699115c}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{eab50ba4-6233-11de-bf5b-009027bb14a0}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =E:\log.exe
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné !
################## | ! Fin du rapport # UsbFix V6.099 ! |
merci bien
Configuration: Windows XP / Firefox 3.0.18
6 réponses
-
Bonjour,
Evite de poster ton rapport dans d'autre sujet sinon tu ne recevra pas d'aide ici car tu perturbe les sujets dans lesquels tu t'immisce
• Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
• Double-clique sur le raccourci UsbFix présent sur ton Bureau pour le lancer.
• Choisis l'option 2 (Suppression).
• Ton Bureau disparaîtra et le PC redémarrera.
• Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.
• Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.
Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).-
voici le rapport
############################## | UsbFix V6.099 |
User : Prof (Administrateurs) # COEUR
Update on 11/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 10:32:41 | 16/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 15,93 Go (7,72 Go free) # NTFS
D:\ -> Disque fixe local # 58,59 Go (55,31 Go free) [donnee] # NTFS
F:\ -> Disque amovible # 1,93 Go (1,93 Go free) # FAT32
I:\ -> Disque CD-ROM
################## | Elements infectieux |
C:\Documents and Settings\Prof\autorun.inf
C:\WINDOWS\System32\autorun.inf
################## | Registre |
[HKLM\SOFTWARE\Classes\CLSID\MADOWN]
[HKCR\CLSID\MADOWN]
[HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]
[HKLM\SYSTEM\ControlSet001\Services\AVPsys]
[HKLM\SYSTEM\ControlSet003\Services\AVPsys]
[HKLM\software\microsoft\windows nt\currentversion\winlogon] "Taskman"
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{05f84d54-e5c4-11dc-bd03-00195b38c6a1}
Shell\AutoRun\command =E:\vfjc8mxm.exe
Shell\explore\Command =E:\vfjc8mxm.exe
Shell\open\Command =E:\vfjc8mxm.exe
HKCU\..\..\Explorer\MountPoints2\{06edd5b9-1d36-11df-807c-009027bb14a0}
Shell\AutoRun\command =E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\MsGv.exe
Shell\open\command =E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\MsGv.exe
HKCU\..\..\Explorer\MountPoints2\{0bc35952-229b-11df-8089-009027bb14a0}
Shell\AutoRun\command =folder.tmp/tmp.exe
Shell\explore\command =folder.tmp/tmp.exe
Shell\open\command =folder.tmp/tmp.exe
HKCU\..\..\Explorer\MountPoints2\{0ca28190-ea7b-11dc-bd0d-00195b38c6a1}
Shell\AutoRun\command =J:\8ng8w.com
Shell\explore\Command =J:\8ng8w.com
Shell\open\Command =J:\8ng8w.com
HKCU\..\..\Explorer\MountPoints2\{0d63e980-b1a7-11de-bfea-009027bb14a0}
Shell\AutoRun\command =ZABORAVI/nikada.exe
Shell\explore\command =ZABORAVI/nikada.exe
Shell\open\command =ZABORAVI/nikada.exe
HKCU\..\..\Explorer\MountPoints2\{17682695-e388-11dc-bcfd-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{299f31f3-5674-11de-bf42-009027bb14a0}
Shell\AutoRun\command =E:\memorybar.exe
HKCU\..\..\Explorer\MountPoints2\{34694a2c-8e19-11dd-be20-009027bb14a0}
Shell\AutoRun\command =E:\nfdmg.com
Shell\explore\Command =E:\nfdmg.com
Shell\open\Command =E:\nfdmg.com
HKCU\..\..\Explorer\MountPoints2\{36c11b44-3ae4-11dd-bd9b-00195b38c6a1}
Shell\AutoRun\command =J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
Shell\open\command =J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
HKCU\..\..\Explorer\MountPoints2\{3df408d9-e91c-11dc-bd07-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{4af2ee91-5c06-11de-bf4e-009027bb14a0}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =E:\log.exe
HKCU\..\..\Explorer\MountPoints2\{9eca6a72-5d52-11dd-bdd0-00192163db03}
Shell\Auto\command =auto.exe
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
Shell\Ouvrir\command =log.exe
HKCU\..\..\Explorer\MountPoints2\{abbd055a-346f-11dd-bd90-00195b38c6a1}
Shell\AutoRun\command =J:\LaunchU3.exe -a
HKCU\..\..\Explorer\MountPoints2\{abbd055b-346f-11dd-bd90-00195b38c6a1}
Shell\AutoRun\command =K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
Shell\open\command =K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
HKCU\..\..\Explorer\MountPoints2\{af1320dd-0534-11dd-bd3d-00195b38c6a1}
Shell\AutoRun\command =J:\q83iwmgf.bat
Shell\explore\Command =J:\q83iwmgf.bat
Shell\open\Command =J:\q83iwmgf.bat
HKCU\..\..\Explorer\MountPoints2\{bded4390-4999-11dd-bdbb-00195b38c6a1}
Shell\AutoRun\command =E:\RECYCLER\S-1-6-21-2438476501-1644491937-701003331-1213\WinMgmt.exe
Shell\open\command =E:\RECYCLER\S-1-6-21-2438476501-1644491937-701003331-1213\WinMgmt.exe
HKCU\..\..\Explorer\MountPoints2\{bf64acfc-5e31-11dd-bdd3-00192163db03}
Shell\AutoRun\command =J:\g2pfnid.com
Shell\explore\Command =J:\g2pfnid.com
Shell\open\Command =J:\g2pfnid.com
HKCU\..\..\Explorer\MountPoints2\{c10df426-ae00-11de-bfe5-009027bb14a0}
Shell\AutoRun\command =E:\folder.tmp/tmp.exe
Shell\explore\command =E:\folder.tmp/tmp.exe
Shell\open\command =E:\folder.tmp/tmp.exe
HKCU\..\..\Explorer\MountPoints2\{c1400634-ef31-11dc-bd17-00195b38c6a1}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =log.exe
HKCU\..\..\Explorer\MountPoints2\{cb6b734e-dac6-11dc-bce8-00047699115c}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
HKCU\..\..\Explorer\MountPoints2\{eab50ba4-6233-11de-bf5b-009027bb14a0}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
Shell\Ouvrir\command =E:\log.exe
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné !
################## | ! Fin du rapport # UsbFix V6.099 ! |
-
-
Tu n'a pas sélectionner l'option 2 suis bien la procédure
-
-
J'ai déjà averti pour le premier doublon ce sujet là a été créé avant .
Il a juste la facheuse tendance à copier coller son rapport un peu partout nouveau sujet voir même sujet d'autre membres. -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
-
• Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.
Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).
