View original (French)

Infection win32/tenga horrible

Evelsus -  
jlpjlp Posted messages 52399 Status Security Contributor -
Hello,
here is my problem:
Last night, wanting to customize the appearance of Windows XP, I downloaded a file from themexp.org.
After the installation, I restart my PC, and when I reach the session choice screen, I cannot open my session: it says "loading your personal settings," then "logging off," and goes back to the welcome screen (session choice).
I decide to format my PC, which is not a problem for me since all my files are on my two other partitions.
The problem is that after formatting, I cannot open any *.exe files (the drivers for the PC and the router, among others). By some miracle, I manage to install NOD32. I scan my PC with it (without updates, as I do not have internet access), which detects 860 infected files (O_O): almost all my setup files on partition D:/ as well as nearly all the files in C:/Windows. However, all my mp3s and concerts on partition E:/ are intact, according to NOD32.
The files are all infected with win32/TENGA. I have reformatted my PC again: same problem.
I searched the internet extensively but found no solution to my problem.
Please, does anyone know how to disinfect all these files, as I would like to keep them: these are the drivers for my PC that I found very difficult to locate, and I'm not sure I can find them again.
Thank you in advance.
Configuration: Windows XP Internet Explorer 6.0

3 answers

  1.
    jlpjlp Posted messages 52399 Status Security Contributor 5 041
     
    Hi
    if it's a Windows version without SP2, you only have a few seconds of lifespan!!!
    the simplest thing is to reformat...

    you need to put a firewall before going online:

    Online Armor or KERIO or JETICO or ZONE ALARM (only use the free firewall)

    http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

    https://forum.pcastuces.com/sujet.asp?f=25&s=35606
    https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
    https://manuelsdaide.com/contact/
    http://www.open-files.com/forum/index.php?showtopic=29277
    http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

    ____________________

    so download a firewall then reformat your computer, then install your firewall and your antivirus, then go online and update Windows.
    0
  2. Evelsus
     
    arf yes I thought about it, but I don't have internet access from my PC, and I can't open the executables :'(
    And when I format, the problem is always there... I tried installing Zonealarm, but the virus won't let me launch it... :s
    0
  3. jlpjlp Posted messages 52399 Status Security Contributor 5 041
     
    ok let's try!

    ________________
    paste a hijackthis report

    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

    manual:
    http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
    https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

    I recommend renaming Hijackthis to counter a possible Vundo infection.

    for example: Rename the HijackThis.exe file to eden.exe, for that, right-click on the HijackThis.exe file and choose rename from the list

    Then with Explorer create a folder c:\hijackthis
    Unzip Hijackthis into this folder.
    This is important for backups."
    ______________

    Download SDFix (created by AndyManchesta) and save it on your Desktop.
    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
    Double-click on SDFix.exe and choose Install to extract it to a dedicated folder on the Desktop. Restart your computer in safe mode by following the procedure below:
    • Restart your computer
    • After you hear the computer beep at startup, but before the Windows icon appears, tap the F8 key (one press per second).
    • Instead of the normal Windows loading, a menu with different options should appear.
    • Choose the first option to run Windows in safe mode, then press "Enter".
    • Choose your account.
    Scroll the list of instructions below:
    • Open the SDFix folder that has just been created in the C:\ directory and double-click on RunThis.bat to launch the script.
    • Press Y to start the cleanup process.
    • It will remove services and registry entries from certain trojans found and then prompt you to press a key to restart.
    • Press a key to restart the PC.
    • Your system will take longer to restart than usual as the tool will continue to run and delete files.
    • After the Desktop loads, the tool will finish its work and display Finished.
    • Press a key to finish executing the script and load your Desktop icons.
    • Once the Desktop icons are displayed, the SDFix report will open on the screen and will also be saved in the SDFix folder under the name Report.txt.
    • Finally, copy/paste the content of the Report.txt file into your next response on the forum

    -------------------------------------

    Download ComboFix from sUBs: Rename it before any installation, for example, name it "KillBagle". help here: https://forum.pcastuces.com/sujet.asp?f=25&s=37315

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Save it on your desktop and nowhere else!

    Help using combofix here: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

    Double-click on combofix, It will ask you a question, answer by pressing 1 and enter to confirm, let it guide you.
    Wait for combofix to finish, a report will be created. Post the report.
    ______________________

    paste the report from an online scan
    with one of the following:

    bitdefender online:
    http://www.bitdefender.fr/scan_fr/scan8/ie.html

    Panda online:
    http://pandasoftware.fr

    Kaspersky online
    https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
    0