Utilisation de list kill'em

Fermé
Mr Jill - 13 juin 2010 à 12:56
 Utilisateur anonyme - 3 mars 2011 à 10:18
Bonjour, j'ai été infecter par un ou plusieur virus et je n'arrive pas a m'en débarrasser. Quelqu'un m'avait proposer list kill'em mais je n'avait eu le temps de m'en servir. Si quelqu'un sait s'en servir aidez -moi. Merci



A voir également:

121 réponses

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
No active process named ApplicationUpdater.exe was found!
========== SERVICES/DRIVERS ==========
Error: No service named Application Updater was found to stop!
Service\Driver key Application Updater not found.
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3982350614-2042332163-1476040662-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{d51d388b-f5dc-471a-a1ce-5e2d671091c0} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}\ not found.
File C:\Program Files\Mininova-Vuze\tbMini.dll not found.
Prefs.js: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 removed from extensions.enabledItems
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}\ not found.
File C:\Program Files\Mininova-Vuze\tbMini.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{d51d388b-f5dc-471a-a1ce-5e2d671091c0} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}\ not found.
File Vuze\tbMini.dll not found.
Registry value HKEY_USERS\S-1-5-21-3982350614-2042332163-1476040662-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D51D388B-F5DC-471A-A1CE-5E2D671091C0} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D51D388B-F5DC-471A-A1CE-5E2D671091C0}\ not found.
File Vuze\tbMini.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HWSetup not found.
Registry value HKEY_USERS\S-1-5-21-3982350614-2042332163-1476040662-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ares not found.
Registry value HKEY_USERS\S-1-5-21-3982350614-2042332163-1476040662-1000\Software\Microsoft\Windows\CurrentVersion\Run\\MsgCenterExe not found.
Registry value HKEY_USERS\S-1-5-21-3982350614-2042332163-1476040662-1000\Software\Microsoft\Windows\CurrentVersion\Run\\TOSCDSPD not found.
File move failed. C:\Users\John & Mathilde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk scheduled to be moved on reboot.
Starting removal of ActiveX control {444785F1-DE89-4295-863A-D46C3A781394}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{444785F1-DE89-4295-863A-D46C3A781394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{444785F1-DE89-4295-863A-D46C3A781394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{14c344d4-6616-11de-bd4a-001b38b5966a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14c344d4-6616-11de-bd4a-001b38b5966a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{14c344d4-6616-11de-bd4a-001b38b5966a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14c344d4-6616-11de-bd4a-001b38b5966a}\ not found.
File H:\start.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7141f0a-773f-11dd-bfc8-001b38b5966a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a7141f0a-773f-11dd-bfc8-001b38b5966a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7141f0a-773f-11dd-bfc8-001b38b5966a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a7141f0a-773f-11dd-bfc8-001b38b5966a}\ not found.
File G:\start.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7c6a7ac-6206-11dd-9bdc-001b38b5966a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7c6a7ac-6206-11dd-9bdc-001b38b5966a}\ not found.
File D:\travel&work.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7c6a7ac-6206-11dd-9bdc-001b38b5966a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7c6a7ac-6206-11dd-9bdc-001b38b5966a}\ not found.
File D:\travel&work.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PWRISOVM.EXE not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task not found.
========== FILES ==========
File\Folder C:\Program Files\Application Updater not found.
File\Folder C:\Users\Marie-Luce\AppData\Roaming\8D99F46CF8FF999E696CEDD97AF86A93 not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: John & Mathilde
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Marie-Luce
->Temp folder emptied: 706658 bytes
->Temporary Internet Files folder emptied: 5303577 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 84883427 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2468 bytes

User: Public

User: TEMP

User: TEMP.PC-de-Luce

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1691339 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 88.00 mb

Error: Unable to interpret <? Clique sur "Correction" pour lancer la suppression.> in the current context!
Error: Unable to interpret <? Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.> in the current context!

OTL by OldTimer - Version 3.2.6.0 log created on 06152010_204747

Files\Folders moved on Reboot...
File\Folder C:\Users\John & Mathilde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk not found!

Registry entries deleted on Reboot...
0
Utilisateur anonyme
15 juin 2010 à 20:59
refais un scan OTL simple
0
c'est parti...
0
les rapports des anciens scan et autres, ils me sont inutiles maintenand ?
0
si jamais j'ai fait un scan a 60 jours et tout sur tout
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Utilisateur anonyme
15 juin 2010 à 21:03
oui
0
http://www.cijoint.fr/cjlink.php?file=cj201006/cijjEgaE7J.txt
0
http://www.cijoint.fr/cjlink.php?file=cj201006/cijaCZz7Wn.txt
0
Utilisateur anonyme
15 juin 2010 à 21:22
▶ Télécharge : Gmer (by Przemyslaw Gmerek) et enregistre-le sur ton bureau

Desactive toutes tes protections le temps du scan de gMer

Pour XP => double clique sur gmer.exe
Pour Vista et 7 => clique droit "executer en tant que...."

▶ Dezippe gmer ,cliques sur l'onglet rootkit,lances le scan,des lignes rouges vont apparaitre.

▶ Les lignes rouges indiquent la presence d'un rootkit.Postes moi le rapport gmer (cliques sur copy,puis vas dans demarrer ,puis ouvres le bloc note,vas dans edition et cliques sur coller,le rapport gmer va apparaitre,postes moi le)

Ensuite

▶ sur les lignes rouge:

▶ Services:cliques droit delete service
▶ Process:cliques droit kill process
▶ Adl ,file:cliques droit delete files
0
pour l'instant il m'a demander tout seul de lancer le scan...
0
mon ordi a laggé pendant le scan et s'est éteint...je recommence désoler
0
j'ai vraiment un probleme... pareil l'écran bleu et s'éteint...
0
Bon ben sa fontionne vraiment pas...
0
J'y vais donc merci pour ce que vous avez déjà fait ;) mais je dois y aller...donc a une prochaine fois, et dites-moi si vous avez une idée pour me débarrasser de ce sale truc... Bonne soirée
0
Utilisateur anonyme
15 juin 2010 à 22:20
il faudra reessayer gMer en mode sans echec
0
de toute façon je passe l'année pas grave les exa demain^^...je veux essayer en mode sans échec
0
http://www.cijoint.fr/cjlink.php?file=cj201006/cijbqBa6j6.txt
Voilà le rapport, mais je n'arrive pas a delete le service, il y a un message d'erreur...
0
Utilisateur anonyme
15 juin 2010 à 23:10
DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

▶ Télécharge List_Kill'em

et enregistre le sur ton bureau

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

Laisse coché :

♦ Executer Shortcut
♦ Executer List_Kill'em

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.
0
ok je le ferais cet aprèm vers 3h
0
Utilisateur anonyme
16 juin 2010 à 07:08
salut

ca marche :)
0
http://www.cijoint.fr/cjlink.php?file=cj201006/cijrxHIOQD.txt
0