Win32.agent.pz Fermé

Question

Bonsoir ^^

apres un scan de spybot search and destroy, le rapport me dis avoir trouvé un ver nommé "Win32.agent.pz"

les fichiers sont C:Windows\system32\wsnpoem\video.dll etC:Windows\system32\wsnpoem\

ils ne peuvent etre supprimé par spybot car ils sont en cours d'exploitation.(même apres un scan apres redemarrage)

Pouvez vous m'aider a les supprimer de mon pc?


Merci d'avance^^

blaireau02 · Answer

Bonsoir
Essaie le scan et la correction en mode sans échec. (touche F8 au démarrage du PC)

Faust · Answer

je viens d'essayer et c'est toujours la même reponse:

les fichiers sont consideré comme actifs (en memoire)

tu vois une autre solution? ou est ce que je peut supprimer ces fichiers sans risque pour mon pc?

uNk · Answer

Bonjour, 
utilise le logiciel SDfix !!!
Tu le trouve avec google, tu dezip sur ton bureau, tu relance ton pc en mode sans échec (portable F12 - PC F8) et tu lance le .bat
Apres un scan etc le logiciel va redémarrer ton pc et le démarrage sera long, mais le logiciel va fixer ca. 
Il crééra un rapport comme ca :

SDFix: Version 1.109

Run by Administrateur on 16/10/2007 at 20:48

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\uNk\Bureau\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

Trojan Files Found:

C:\WINDOWS\system32\wsnpoem\audio.dll  - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll  - Deleted
C:\WINDOWS\system32
tos.exe  - Deleted


Folder C:\WINDOWS\system32\wsnpoem - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found. 

C:\WINDOWS\system32
No streams found. 

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"D:\HLSW\hlsw.exe"="D:\HLSW\hlsw.exe:*:Enabled:HLSW"
"C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"D:\Warcraft III\Warcraft III.exe"="D:\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"D:\Amphibizorus\mirc.exe"="D:\Amphibizorus\mirc.exe:*:Enabled:mIRC"
"D:\mIRC\mirc.exe"="D:\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\system32\SolidStateNetworks\SolidStateION\solidnm.exe"="C:\WINDOWS\system32\SolidStateNetworks\SolidStateION\solidnm.exe:*:Enabled:Solid State Networks Browser Plugin"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\uNk\Bureau\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sat 30 Jun 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 28 Apr 2007    35,706,549 A..H. --- "C:\Documents and Settings\uNk\Bureau\Les sauvages\9792.exe"
Tue  9 Oct 2007       197,120 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\~1B.tmp"
Mon 25 Jun 2007         1,120 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic1.tmp"
Sun  6 May 2007           142 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic1C5.tmp"
Mon  7 May 2007           220 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic1EE.tmp"
Tue 26 Jun 2007           507 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic2.tmp"
Sat 28 Jul 2007           334 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic21.tmp"
Sat 11 Aug 2007           454 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic26.tmp"
Mon 25 Jun 2007           438 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic272.tmp"
Mon 25 Jun 2007           110 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic279.tmp"
Mon 25 Jun 2007           518 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic27D.tmp"
Sun  5 Aug 2007           167 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic2C.tmp"
Tue 26 Jun 2007           533 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic3.tmp"
Tue 26 Jun 2007           528 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic33.tmp"
Tue 26 Jun 2007           497 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic48.tmp"
Sun  6 May 2007           887 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic5.tmp"
Sat  4 Aug 2007           352 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic58.tmp"
Tue 26 Jun 2007            92 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic59.tmp"
Sat 28 Jul 2007           695 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic6.tmp"
Sun  5 Aug 2007           167 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic7.tmp"
Mon  8 Oct 2007           370 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	ic9.tmp"
Sat 28 Jul 2007           142 A..H. --- "C:\Documents and Settings\uNk\Local Settings\Temp\Free Download Manager	icB5.tmp"

Finished! 

Et le probleme sera fixé !!!! 

Kiss

Win32.agent.pz

3 réponses

Discussions similaires