Infecté par des virus popup Résolu

Question

Bonjour,

J'ai des problèmes avec mon portable. J'ai des virus popup dont je ne suis pas capable de me débarassé. Merci à celui qui va me donner un coup de pouce

Configuration: Windows XP / Safari 531.22.7

gen-hackman · Answer

salut ;

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

&#9654 Télécharge List_Kill'em et enregistre le sur ton bureau 

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.
un autre rouge et noir te servira a desinstaller le prog a la fin de la desinfection.

&#9654 laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

&#9654 Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

gen-hackman · Answer

&#9654 Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

&#9654 choisis l'Option Clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

&#9654 colle le contenu dans ta reponse

Utilisateur anonyme · Answer

Kill'em by g3n-h@ckm@n 1.6.0.4 
 
User : Administrateur (Administrateurs) 
Update on 23/03/2010 by g3n-h@ckm@n ::::: 19.30
Start at: 18:02:25 | 2010-03-24

Intel(R) Core(TM)2 Duo CPU     T7250  @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : McAfee VirusScan Enterprise 8.5.0.781 [ Enabled | Updated ]

C:\ -> Disque fixe local | 68,36 Go (42,48 Go free) | NTFS
D:\ -> Disque fixe local | 29,29 Go (28,89 Go free) [DONNEES] | NTFS
E:\ -> Disque fixe local | 14,13 Go (14,07 Go free) [GHOST] | NTFS
F:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxserv.exe
C:\WINDOWS\system32\lxdxcoms.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\McAfee\Common Framework
aPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SMINST\PCAngel.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js 
Quarantined & Deleted !! : C:\WINDOWS\002718_.tmp 
Quarantined & Deleted !! : C:\WINDOWS\bk23567.dat 
Quarantined & Deleted !! : C:\WINDOWS\fdgg34353edfgdfdf 
Quarantined & Deleted !! : C:\WINDOWS\lgo 
 
Quarantined & Deleted !! : C:\WINDOWS\System32\_003083_.tmp.dll 
Quarantined & Deleted !! : C:\WINDOWS\System32\x64 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Datadr_1269296700.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Datadr_1269302825.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Datadr_1269383250.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Datadr_1269388273.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Datadr_1269467594.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Datadr_1269467926.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Data\010112010146111103.xxe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Data\010112010146114101.xxe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Application Data\01011201014650115.xxe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Temp\all.cpr 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Local Settings\Temp\dw.log 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\haroldshills_install.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\icytower14.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\ReimagePackage.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\Toolbarfr.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\isconfig.dat 
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sysfbtray  
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Ip6Fw : Start = 2   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

gen-hackman · Answer

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654 dans la colonne de gauche , mets tout sur "all"

ne modifie pas ceci : 

"files created whithin" et "files modified whithin" 

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

&#9654&#9654 Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.

Utilisateur anonyme · Answer

Bonjour,
Votre lien de Oldtimer ne fonctionne pas,
ci vous ;e pouvez, il serait gentil de le réparer

Utilisateur anonyme · Answer

Bonjour,
voici mes liens:

OTL.txt:  http://www.cijoint.fr/cjlink.php?file=cj201003/cijsJ8Z1O6.txt



Extras.txt:  http://www.cijoint.fr/cjlink.php?file=cj201003/cijsxwouar.txt

Utilisateur anonyme · Answer

Bonjour,

Voici eux de ma session administrateur:

Otl: http://www.cijoint.fr/cjlink.php?file=cj201003/cijntQjt2p.txt


Extras: http://www.cijoint.fr/cjlink.php?file=cj201003/cijzipIS1q.txt

gen-hackman · Answer

&#9654 Télécharge UsbFix

 (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

&#9654 Double clic sur le raccourci UsbFix présent sur ton bureau .

&#9654 Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

&#9654 Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée] 

&#9654 Laisse travailler l'outil.

&#9654 Ensuite post le rapport UsbFix.txt qui apparaitra.

Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

 Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Utilisateur anonyme · Answer

############################## | UsbFix V6.100 |

User : Administrateur (Administrateurs) # MARTINEAUJ
Update on 18/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 17:52:02 | 2010-03-26
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU     T7250  @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : McAfee VirusScan Enterprise 8.5.0.781 [ Enabled | Updated ]

C:\ -> Disque fixe local # 68,36 Go (42,37 Go free) # NTFS
D:\ -> Disque fixe local # 29,29 Go (28,89 Go free) [DONNEES] # NTFS
E:\ -> Disque fixe local # 14,13 Go (14,07 Go free) [GHOST] # NTFS
F:\ -> Disque CD-ROM
G:\ -> Disque amovible # 1,88 Go (1,85 Go free) # FAT

################## | Elements infectieux |

G:\autorun.inf  

################## | Registre |


################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{4434c580-0a30-11dd-9d5d-806d6172696f}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

################## | Vaccin |


################## | ! Fin du rapport # UsbFix V6.100 ! |

gen-hackman · Answer

ok option 2...............

Utilisateur anonyme · Answer

Je pense que ce virus n'est plus dans mon ordinateur. Aujourd'hui, je n'ai remarqué aucun acte de virus

gen-hackman · Answer

et ca c'est quoi ?

HKCU\..\..\Explorer\MountPoints2\{4434c580-0a30-11dd-9d5d-806d6172696f}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

Utilisateur anonyme · Answer

J'ai trouvé le nom du virus qui est dans mon ordinateur

il s'agit de Xp defender pro

gen-hackman · Answer

Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.



&#9654 Télécharge :

Malwarebytes  

ou  :

Malwarebytes

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

&#9654 Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

Utilisateur anonyme · Answer

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 3939

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2010-03-31 20:50:20
mbam-log-2010-03-31 (20-50-20).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Elément(s) analysé(s): 250479
Temps écoulé: 1 heure(s), 19 minute(s), 26 seconde(s)

Processus mémoire infecté(s): 3
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 11
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 61

Processus mémoire infecté(s):
C:\Documents and Settings\Administrateur\Local Settings\Temp\Hpr.exe (Trojan.FraudPack) -> Unloaded process successfully.
C:\WINDOWS\Hhesya.exe (Trojan.FraudPack) -> Unloaded process successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\WINDOWS\system32\clbcoko.dll (Worm.KoobFace) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swoko (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql600oko (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_QL600OKO (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SWOKO (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yvibbbha8c (Trojan.FraudPack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvc (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\secfile\shell\open\command\(default) (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Administrateur\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Administrateur\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Administrateur\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.15,93.188.161.145 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{751e7fd4-53ae-449e-a0d3-8e614bfc2124}\DhcpNameServer (Trojan.DNSChanger) -> Data: 93.188.164.15,93.188.161.145 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{751e7fd4-53ae-449e-a0d3-8e614bfc2124}\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.15,93.188.161.145 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{d46908fb-4d97-4c4d-8d00-02d665cf8b7e}\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.15,93.188.161.145 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\WINDOWS\system32\clbcoko.dll (Worm.KoobFace) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Local Settings\Temp\Hpr.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.
C:\WINDOWS\Hhesya.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\Hpq.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\00004baa (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\DQPU513E\Setup_312s2[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\IF9OETQO\p[1].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LHZ99H29\p[2].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269302769.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269308610.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269352672.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269363783.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269364268.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269383009.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269436294.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\F5SCEZCJ\p[1].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\IRVYPZAD\p[1].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\IRVYPZAD\p[2].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\IRVYPZAD\p[3].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\IRVYPZAD\p[4].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\K1TJ8MEF\go[1].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\QWO0QKUX\p[1].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\QWO0QKUX\Setup_312s1[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\UMSPI9ON\p[1].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temporary Internet Files\Content.IE5\ZR6NXQ3E\go[1].exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Mes documents\setup.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\rdr_1269296700.exe.Kill'em (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\rdr_1269302825.exe.Kill'em (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\rdr_1269383250.exe.Kill'em (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\rdr_1269388273.exe.Kill'em (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\rdr_1269467594.exe.Kill'em (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\rdr_1269467926.exe.Kill'em (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{36D576C6-D89E-469E-9FBC-ABF0712A416E}\RP142\A0096703.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{36D576C6-D89E-469E-9FBC-ABF0712A416E}\RP142\A0096704.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{36D576C6-D89E-469E-9FBC-ABF0712A416E}\RP142\A0096705.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{36D576C6-D89E-469E-9FBC-ABF0712A416E}\RP142\A0096706.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{36D576C6-D89E-469E-9FBC-ABF0712A416E}\RP142\A0096707.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{36D576C6-D89E-469E-9FBC-ABF0712A416E}\RP142\A0096708.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\bill104.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\mrxoko.sys (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\00004c8e.tmp (Rogue.Multiple) -> Delete on reboot.
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temp\zpskon_1269458438.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Temp\zpskon_1269466737.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\010112010146111103.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\010112010146114101.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\01011201014650115.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269300841.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269301142.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269301143.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269301144.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269301149.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269301150.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269352977.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269352979.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269352981.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269352983.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269364570.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\martineauj\Local Settings\Application Data\rdr_1269364571.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

gen-hackman · Answer

je peux avoir le rapport de usbfix option suppression ?

Infecté par des virus popup

16 réponses

Discussions similaires

Newsletters