TR/téléchargeur.gen

Question

Hello, after spending a lot of time trying to remove this virus, looking for solutions on the internet, particularly in forums, I have indeed tried a huge number of solutions, many programs and I am desperate, this virus keeps coming back continuously for several weeks, many times each day, it attacks my services.exe and csrss.exe constantly and downloads other viruses, I have tried ComboFix, Spybot Search and Destroy, Avira AntiVir (my antivirus), I also tried to set up ZoneAlarm, what works best is still Malwarebytes, which removes the virus but the next day or the day after it is back, I had no virus before all this or really nothing too annoying but now it is wrecking my computer and it is becoming burdensome. I am copying below my last Malwarebytes report that I just made. Thank you for providing me with a solution to permanently get rid of this virus.

Malwarebytes Report:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5105

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

11/13/2010 2:28:57 PM
mbam-log-2010-11-13 (14-28-57).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|R:\|)
Items scanned: 210254
Elapsed time: 50 minute(s), 32 second(s)

Infected memory processes: 1
Infected memory modules: 0
Infected Registry keys: 0
Infected Registry values: 8
Infected Registry data items: 1
Infected folders: 0
Infected files: 10

Infected memory processes:
D:\WINDOWS\system\comrepl.exe (Trojan.Agent) -> No action taken.

Infected memory modules:
(No harmful items detected)

Infected Registry keys:
(No harmful items detected)

Infected Registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mstsc (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cisvc (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\comrepl (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dllhst (Trojan.Downloader) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ieudinit (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\logman (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rsvp (Trojan.Agent) -> No action taken.

Infected Registry data items:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Data: d:\windows\system\cisvc.exe -> No action taken.

Infected folders:
(No harmful items detected)

Infected files:
D:\Documents and Settings\Administrateur\Application Data\esentutl.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\Administrateur\Application Data\ieudinit.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\Administrateur\Application Data\logman.exe (Trojan.Agent) -> No action taken.
D:\WINDOWS\system32\drivers\cisvc.exe (Trojan.Agent) -> No action taken.
D:\WINDOWS\system32\drivers\logman.exe (Trojan.Agent) -> No action taken.
D:\WINDOWS\mstsc.exe (Trojan.Agent) -> No action taken.
D:\WINDOWS\system\cisvc.exe (Trojan.Agent) -> No action taken.
D:\WINDOWS\system\comrepl.exe (Trojan.Agent) -> No action taken.
D:\WINDOWS\system\dllhst3g.exe (Trojan.Downloader) -> No action taken.
D:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\rsvp.exe (Trojan.Agent) -> No action taken.

----

Best regards Raph0u. (Sorry for the typos)

Configuration: Windows XP / Safari 534.7

Raph0u · Answer

After selecting to delete everything, I have this report:
Infected memory process(es):
D:\WINDOWS\system\comrepl.exe (Trojan.Agent) -> Unloaded process successfully.

Infected memory module(s):
(No harmful items detected)

Infected registry key(s):
(No harmful items detected)

Infected registry value(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mstsc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cisvc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\comrepl (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dllhst (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ieudinit (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\logman (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rsvp (Trojan.Agent) -> Quarantined and deleted successfully.

Infected registry data item(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Data: d:\windows\system\cisvc.exe -> Quarantined and deleted successfully.

Infected folder(s):
(No harmful items detected)

Infected file(s):
D:\Documents and Settings\Administrateur\Application Data\esentutl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\ieudinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\logman.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\drivers\cisvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\drivers\logman.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system\cisvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system\comrepl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system\dllhst3g.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\rsvp.exe (Trojan.Agent) -> Quarantined and deleted successfully.

archet9 · Answer

Hello,  Can you show us your latest Combofix report please?  P.S.: You can find it here:  C:\Combofix.txt  see you+ -- ....."security contributor".....o°ô"

archet9 · Answer

Download UsbFix (by C_XX & El Desaparecido) to the Desktop
http://www.teamxscript.org/usbfixTelechargement.html

! ! Connect all your removable devices (USB keys, external HDDs, etc...) without opening them !! * launch UsbFix
- On XP double-click the icon to launch the tool.
- On Vista/Seven right-click the icon and select "Run as administrator" from the context menu.
* Click on the "Search" button
* Wait for the scan to complete, which may take several minutes
* The report should open automatically at the end of the scan
* Copy/paste the report into the next message

The report is saved at the root of drive C:\Usbfix.txt

"Process.exe" is detected by some antivirus programs as a RiskTool. It is not a virus, but a utility designed to terminate processes. It's best to temporarily disable your antivirus

--
....."security contributor".....o°ô"

archet9 · Answer

!! Close all your running applications and disable your antivirus resident protection !!

Connect all your removable drives (USB keys, external hard drives, etc.) without opening them

* Relaunch UsbFix by selecting now "Deletion"
- On XP, double-click the icon to launch the tool.
- On Vista/Seven, right-click the icon and choose "Run as administrator" from the context menu.
* UsbFix scans your PC, let the tool work (the desktop may disappear)
* At the end of the cleaning, click OK in the dialog box
* Upload the requested zip folder
* The report should open automatically, copy/paste it into the next message

It is recommended to restart the PC after this operation

The report is saved at the root of the disk C:\Usbfix.txt

Reminder: "Process.exe" is detected by some antivirus as a RiskTool. It is not a virus, but a utility designed to terminate processes
....."security contributor".....o°ô"

archet9 · Answer

You forgot the beginning of the report....  ==> Please repost it  -- ....."security contributor".....o°ô"

archet9 · Answer

> Close all your browsers (so copy or print the instructions beforehand)
- Create a new text document: right-click on the desktop > New > Text Document,
Save this file on your Desktop (and nowhere else!) under the name CFScript.txt
and copy/paste the following lines into it:

KillAll::

Rootkit::
npggsvc

(Click on the CFScript file, hold down your finger, and drag the mouse so that the CFScript icon covers the Combofix icon. Release the mouse.)
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Combofix will start.
- A blue window will appear: in the message that appears ( Type 1 to continue, or 2 to abort), type 1 and then press Enter.
- Wait for the scan to finish. The desktop will disappear several times: this is normal!
- Do not touch anything until the scan is complete, or the PC may crash!
- Once the scan is finished, a report will display: post its contents.
Note: If the file does not open, it is located here > C:\ComboFix.txt
....."security contributor".....o°ô"

TR/téléchargeur.gen

6 answers

Xiaomi redmi note 140 -

New simplified cancellation feature for online purchases

Downloaded .rar file becomes .htm when finished

Self-invoking js function

Computer locked

Question about transferring data ps4 to ps5

Connecting a sony handycam video 8 ccd f555e to an hd tv

How to change my username

Texture issues in enshrouded

Gotek information