Soucis virus Bagle.gen
Lepers
-
Lepers -
Lepers -
Bonjour,
J'ai été infecté par un virus Bagle.gen. J'ai fait pas mal de scan et supprimé pas les fichiers infectés.
Cependant j'ai l'impression que ma connection est lente et qu'il reste une m...
J'ai passé Hijack (ci après le rapport). Quelqu'un peut me dire si il y a quelque chose d'anormal dans le rapport ?
Merci d'avance.
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\HidFind.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fppdis1.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Program Files\Webshots\webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\ELIBAGLA.ABFB H.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.dell.com/fr-fr?c=fr&l=fr&s=gen&redirect=1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [pdfFactory Dispatcher v1] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fppdis1.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [CAPON] C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAPONN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MVS Splash] "C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe"
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyagtTry.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Fenêtre d'état Canon LBP-800.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: EngineServer - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicWALL Agent Service (SWAGENT) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 9843 bytes
J'ai été infecté par un virus Bagle.gen. J'ai fait pas mal de scan et supprimé pas les fichiers infectés.
Cependant j'ai l'impression que ma connection est lente et qu'il reste une m...
J'ai passé Hijack (ci après le rapport). Quelqu'un peut me dire si il y a quelque chose d'anormal dans le rapport ?
Merci d'avance.
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\HidFind.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fppdis1.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Program Files\Webshots\webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\ELIBAGLA.ABFB H.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.dell.com/fr-fr?c=fr&l=fr&s=gen&redirect=1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [pdfFactory Dispatcher v1] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fppdis1.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [CAPON] C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAPONN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MVS Splash] "C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe"
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyagtTry.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Fenêtre d'état Canon LBP-800.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: EngineServer - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicWALL Agent Service (SWAGENT) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 9843 bytes
Configuration: Windows XP Firefox 2.0.0.14
3 réponses
-
slt
vire tes cracks
________
Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic
Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
-----------
* Téléchargez ELIBAGLA en bas de cette page http://www.zonavirus.com/datos/descargas/95/elibagla.asp
* Clique sur le bouton Descargar Elibagla cela va télécharger le fichier, placez le sur votre bureau.
* Double-cliquez dessus pour l'ouvrir
* Assurez-vous que dans le menu déroulant Unidad, vous avez bien C:\
* Vérifiquez aussi que l'option en bas de la fenêtre Eliminar Ficheros Automaticamente est bien cochée
* Cliquez sur le bouton Explorar pour lancer l'analyse
Si, dans le rapport,elibaga tu vois un texte semblable à celui-ci
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.24
a "virus@satinfo.es". Gracias;
envoie ce(s) fichier(s) (dans l'exemple C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.24 ) à l'adresse e-mail indiquée (virus@satinfo.es).
et ils mettront a jour elibaga dans les 48 heures ce qui permettra de virer le virus que tu as!!!
------------
colle le rapport d'un scan en ligne
avec un des suivants:
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
secuser en ligne :
http://www.secuser.com/outils/antivirus.htm
scan en ligne firefox
https://www.trendmicro.com/fr_fr/business.html
__________
tes antivirus et spybot marchent?
si c'est pas le cas reinstalle les-
Merci pour ta réponse voilà, tout est fait :
Rapport combofix:
ComboFix 08-06-05.3 - CDehez 2008-06-06 11:22:18.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.458 [GMT 2:00]
Endroit: C:\Documents and Settings\CDehez\Bureau\Kill.exe
* Création d'un nouveau point de restauration
* Resident AV is active
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\1019515.exe
C:\WINDOWS\system32\drivers\downld\1041343.exe
C:\WINDOWS\system32\drivers\downld\1065109.exe
C:\WINDOWS\system32\drivers\downld\1112515.exe
C:\WINDOWS\system32\drivers\downld\1174843.exe
C:\WINDOWS\system32\drivers\downld\1177687.exe
C:\WINDOWS\system32\drivers\downld\1223531.exe
C:\WINDOWS\system32\drivers\downld\1227093.exe
C:\WINDOWS\system32\drivers\downld\1245203.exe
C:\WINDOWS\system32\drivers\downld\1252390.exe
C:\WINDOWS\system32\drivers\downld\1316625.exe
C:\WINDOWS\system32\drivers\downld\1329593.exe
C:\WINDOWS\system32\drivers\downld\1339109.exe
C:\WINDOWS\system32\drivers\downld\1343796.exe
C:\WINDOWS\system32\drivers\downld\1351640.exe
C:\WINDOWS\system32\drivers\downld\1360734.exe
C:\WINDOWS\system32\drivers\downld\1382359.exe
C:\WINDOWS\system32\drivers\downld\1405343.exe
C:\WINDOWS\system32\drivers\downld\1449640.exe
C:\WINDOWS\system32\drivers\downld\1493265.exe
C:\WINDOWS\system32\drivers\downld\1514984.exe
C:\WINDOWS\system32\drivers\downld\1536875.exe
C:\WINDOWS\system32\drivers\downld\156546.exe
C:\WINDOWS\system32\drivers\downld\1582265.exe
C:\WINDOWS\system32\drivers\downld\15873562.exe
C:\WINDOWS\system32\drivers\downld\1604578.exe
C:\WINDOWS\system32\drivers\downld\16090140.exe
C:\WINDOWS\system32\drivers\downld\16102140.exe
C:\WINDOWS\system32\drivers\downld\16109078.exe
C:\WINDOWS\system32\drivers\downld\1627875.exe
C:\WINDOWS\system32\drivers\downld\1656218.exe
C:\WINDOWS\system32\drivers\downld\1680953.exe
C:\WINDOWS\system32\drivers\downld\1703578.exe
C:\WINDOWS\system32\drivers\downld\1725203.exe
C:\WINDOWS\system32\drivers\downld\1746953.exe
C:\WINDOWS\system32\drivers\downld\1801921.exe
C:\WINDOWS\system32\drivers\downld\1846437.exe
C:\WINDOWS\system32\drivers\downld\1893375.exe
C:\WINDOWS\system32\drivers\downld\1917390.exe
C:\WINDOWS\system32\drivers\downld\1939187.exe
C:\WINDOWS\system32\drivers\downld\1982734.exe
C:\WINDOWS\system32\drivers\downld\2005453.exe
C:\WINDOWS\system32\drivers\downld\2028828.exe
C:\WINDOWS\system32\drivers\downld\2096453.exe
C:\WINDOWS\system32\drivers\downld\2118296.exe
C:\WINDOWS\system32\drivers\downld\2165250.exe
C:\WINDOWS\system32\drivers\downld\2187750.exe
C:\WINDOWS\system32\drivers\downld\2210234.exe
C:\WINDOWS\system32\drivers\downld\2232046.exe
C:\WINDOWS\system32\drivers\downld\2253890.exe
C:\WINDOWS\system32\drivers\downld\2275765.exe
C:\WINDOWS\system32\drivers\downld\2298890.exe
C:\WINDOWS\system32\drivers\downld\2329937.exe
C:\WINDOWS\system32\drivers\downld\2351828.exe
C:\WINDOWS\system32\drivers\downld\2373828.exe
C:\WINDOWS\system32\drivers\downld\2420312.exe
C:\WINDOWS\system32\drivers\downld\2464640.exe
C:\WINDOWS\system32\drivers\downld\2487656.exe
C:\WINDOWS\system32\drivers\downld\2510750.exe
C:\WINDOWS\system32\drivers\downld\2532359.exe
C:\WINDOWS\system32\drivers\downld\2555234.exe
C:\WINDOWS\system32\drivers\downld\2577218.exe
C:\WINDOWS\system32\drivers\downld\2603703.exe
C:\WINDOWS\system32\drivers\downld\2696187.exe
C:\WINDOWS\system32\drivers\downld\2717843.exe
C:\WINDOWS\system32\drivers\downld\272921.exe
C:\WINDOWS\system32\drivers\downld\2752453.exe
C:\WINDOWS\system32\drivers\downld\2765281.exe
C:\WINDOWS\system32\drivers\downld\2810750.exe
C:\WINDOWS\system32\drivers\downld\2834031.exe
C:\WINDOWS\system32\drivers\downld\2857453.exe
C:\WINDOWS\system32\drivers\downld\2880437.exe
C:\WINDOWS\system32\drivers\downld\2902156.exe
C:\WINDOWS\system32\drivers\downld\2923718.exe
C:\WINDOWS\system32\drivers\downld\2945640.exe
C:\WINDOWS\system32\drivers\downld\2968156.exe
C:\WINDOWS\system32\drivers\downld\2990031.exe
C:\WINDOWS\system32\drivers\downld\3011453.exe
C:\WINDOWS\system32\drivers\downld\3038875.exe
C:\WINDOWS\system32\drivers\downld\304703.exe
C:\WINDOWS\system32\drivers\downld\3062062.exe
C:\WINDOWS\system32\drivers\downld\30635578.exe
C:\WINDOWS\system32\drivers\downld\30751812.exe
C:\WINDOWS\system32\drivers\downld\30766750.exe
C:\WINDOWS\system32\drivers\downld\30773718.exe
C:\WINDOWS\system32\drivers\downld\399031.exe
C:\WINDOWS\system32\drivers\downld\421890.exe
C:\WINDOWS\system32\drivers\downld\444078.exe
C:\WINDOWS\system32\drivers\downld\468062.exe
C:\WINDOWS\system32\drivers\downld\503203.exe
C:\WINDOWS\system32\drivers\downld\534937.exe
C:\WINDOWS\system32\drivers\downld\556906.exe
C:\WINDOWS\system32\drivers\downld\643343.exe
C:\WINDOWS\system32\drivers\downld\647296.exe
C:\WINDOWS\system32\drivers\downld\693406.exe
C:\WINDOWS\system32\drivers\downld\738906.exe
C:\WINDOWS\system32\drivers\downld\784718.exe
C:\WINDOWS\system32\drivers\downld\806609.exe
C:\WINDOWS\system32\drivers\downld\852593.exe
C:\WINDOWS\system32\drivers\downld\875640.exe
C:\WINDOWS\system32\drivers\downld\897375.exe
C:\WINDOWS\system32\drivers\downld\919906.exe
C:\WINDOWS\system32\drivers\downld\949421.exe
C:\WINDOWS\system32\drivers\downld\972406.exe
C:\WINDOWS\system32\drivers\downld\997718.exe
C:\WINDOWS\system32\mdm.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SROSA
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-06 to 2008-06-06 ))))))))))))))))))))))))))))))))))))
.
2008-06-06 11:18 . 2008-06-06 11:18 <REP> d-------- C:\Program Files\CCleaner
2008-06-05 11:53 . 2008-06-05 11:53 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}
2008-06-05 11:43 . 2008-06-05 11:43 <REP> d-------- C:\Program Files\Trend Micro
2008-06-05 11:03 . 2008-06-06 11:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-05 09:18 . 2008-06-06 11:28 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 09:18 . 2008-06-05 09:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-05 08:46 . 2008-06-05 08:46 <REP> d-------- C:\Program Files\Lavasoft
2008-06-05 08:45 . 2008-06-05 11:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-04 18:29 . 2008-06-04 18:29 <REP> d-------- C:\Documents and Settings\CDehez\Application Data\Leadertech
2008-05-31 21:26 . 2008-05-31 21:26 <REP> d-------- C:\WINDOWS\speech
2008-05-31 21:25 . 2008-05-31 21:34 <REP> d-------- C:\Program Files\Elan
2008-05-31 19:12 . 2008-05-31 19:12 <REP> d-------- C:\Program Files\NextUp-ScanSoft
2008-05-31 19:10 . 2008-05-31 19:10 <REP> d-------- C:\Program Files\Loquendo
2008-05-30 22:31 . 2008-06-06 11:19 <REP> d-------- C:\Program Files\TextAloud
2008-05-27 18:33 . 2008-05-27 18:33 <REP> d-------- C:\Program Files\Crouzet Automatismes
2008-05-27 18:27 . 2008-05-27 18:32 <REP> d-------- C:\Documents and Settings\CDehez\Application Data\muvee Technologies
2008-05-27 18:24 . 2008-05-27 18:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-27 18:17 . 2008-05-27 18:17 <REP> d-------- C:\Program Files\muvee Technologies
2008-05-27 18:15 . 2008-05-27 18:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\muvee Technologies
2008-05-26 22:47 . 2008-05-27 09:06 <REP> d-------- C:\Program Files\VirtualDub
2008-05-25 21:37 . 2008-05-25 21:37 514,240 --a------ C:\WINDOWS\system32\perfh040.dat
2008-05-25 21:37 . 2008-05-25 21:37 86,490 --a------ C:\WINDOWS\system32\perfc040.dat
2008-05-25 21:26 . 2008-05-25 21:26 <REP> d-------- C:\Program Files\NextUp-Acapela
2008-05-25 19:11 . 2008-06-05 08:23 <REP> d-------- C:\WINDOWS\Lhsp
2008-05-24 20:30 . 2008-05-30 22:52 1,122,304 ---h----- C:\WINDOWS\system32\wodfamop.dll
2008-05-24 20:24 . 2008-05-24 20:27 <REP> d-------- C:\Mng
2008-05-24 19:40 . 2008-05-24 19:40 <REP> d-------- C:\Program Files\Zeallsoft
2008-05-24 14:10 . 2008-05-24 14:10 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Pinnacle VideoSpin
2008-05-23 23:16 . 2008-05-27 08:54 <REP> d-------- C:\Program Files\Pinnacle
2008-05-23 23:16 . 2008-05-23 23:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\VideoSpin
2008-05-23 23:07 . 2008-05-23 23:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Pinnacle
2008-05-22 16:35 . 2008-05-22 16:35 <REP> d-------- C:\Documents and Settings\CDehez\Application Data\vlc
2008-05-21 21:23 . 2008-05-25 19:23 <REP> d-------- C:\Program Files\Cepstral
2008-05-20 06:34 . 2007-12-01 12:32 33,832 --a------ C:\WINDOWS\system32\drivers\MfeRKDK.sys
2008-05-19 21:43 . 2008-05-19 21:43 75 -r-hs---- C:\WINDOWS\CT4SET.BIN
2008-05-19 21:42 . 2008-05-19 21:43 <REP> d-------- C:\Program Files\Reallusion
2008-05-19 21:42 . 2008-05-19 21:42 <REP> d-------- C:\Program Files\Fichiers communs\Reallusion
2008-05-19 11:53 . 2008-05-21 21:47 <REP> d-------- C:\Documents and Settings\CDehez\dwhelper
2008-05-17 13:55 . 2008-05-17 13:55 268 --ah----- C:\sqmdata13.sqm
2008-05-17 13:55 . 2008-05-17 13:55 244 --ah----- C:\sqmnoopt13.sqm
2008-05-16 22:28 . 2008-05-16 22:28 268 --ah----- C:\sqmdata12.sqm
2008-05-16 22:28 . 2008-05-16 22:28 244 --ah----- C:\sqmnoopt12.sqm
2008-05-07 21:54 . 2008-05-07 21:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-07 18:38 . 2008-05-07 18:38 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
2008-05-06 09:16 . 2008-05-06 09:16 <REP> d-------- C:\Program Files\iPod
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 06:22 --------- d-----w C:\Program Files\IrfanView
2008-06-05 01:18 --------- d-----w C:\Program Files\eMule
2008-06-04 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-31 16:38 --------- d-----w C:\Documents and Settings\CDehez\Application Data\ZoomBrowser EX
2008-05-31 16:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-05-26 07:27 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-26 07:25 --------- d-----w C:\Documents and Settings\CDehez\Application Data\AdobeUM
2008-05-25 17:22 --------- d-----w C:\Program Files\Bonjour
2008-05-06 10:21 --------- d-----w C:\Documents and Settings\CDehez\Application Data\Apple Computer
2008-05-06 07:19 --------- d-----w C:\Program Files\Apple Software Update
2008-05-06 07:17 --------- d-----w C:\Program Files\iTunes
2008-05-06 07:14 --------- d-----w C:\Program Files\QuickTime
2008-04-24 11:51 --------- d-----w C:\Documents and Settings\CDehez\Application Data\Microsoft Web Folders
2008-04-24 11:33 --------- d-----w C:\Program Files\Stellar Phoenix Outlook Pst Repair
2008-04-14 20:04 --------- d-----w C:\Program Files\CROUZET
2008-02-27 14:50 88 --sh--r C:\WINDOWS\system32\EB1CDAE68F.sys
2008-02-27 14:52 2,984 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 08:13 176128]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 17:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 17:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 17:36 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 16:59 385024]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 10:04 53248]
"pdfFactory Dispatcher v1"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fppdis1.exe" [2002-06-24 13:06 356352]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [ ]
"CAPON"="C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAPONN.EXE" [2000-04-21 01:00 22528]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"MVS Splash"="C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe" [2008-05-02 00:39 468288]
"McAfee Managed Services Tray"="C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyagtTry.exe" [2008-05-02 00:38 87360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wd.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\NextUp-Acapela\\bin\\acatel_srv.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\eMule\\eMule.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"59152:UDP"= 59152:UDP:SonicWALL Compliance 59152
"59153:UDP"= 59153:UDP:SonicWALL Compliance 59153
R2 EngineServer;EngineServer;"C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe" [2007-12-01 12:30]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;"C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe" /ServiceStart []
R2 RCFOX;SonicWALL IPsec Driver;C:\WINDOWS\system32\Drivers\RCFOX.sys [2003-09-29 15:06]
R2 SWAGENT;SonicWALL Agent Service;C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe [2008-02-20 13:59]
R3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2003-08-20 15:01]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-02 11:06:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 11:28:44
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\Crypserv.exe
C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Apoint\hidfind.exe
C:\Program Files\Apoint\ApntEx.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Program Files\Webshots\Webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-06 11:35:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-06 09:34:57
Pre-Run: 5,422,092,288 octets libres
Post-Run: 5,367,881,728 octets libres
292 --- E O F --- 2008-05-28 21:13:28
Elibagla n'a rien trouvé comme virus.
Rapport Bit defender :
BitDefender Online Scanner
Rapport d'analyse généré à: Fri, Jun 06, 2008 - 13:18:31
Voie d'analyse: A:\;C:\;D:\;E:\;
Statistiques
Temps
01:00:26
Fichiers
113416
Directoires
8630
Secteurs de boot
6
Archives
1623
Paquets programmes
13642
Résultats
Virus identifiés
2
Fichiers infectés
3
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
3
Info sur les moteurs
Définition virus
1256615
Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Analyse des plugins
16
Archive des plugins
42
Unpack des plugins
7
E-mail plugins
6
Système plugins
5
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Documents and Settings\CDehez\Mes documents\Mes images\emoticon\Mnemic-Cyclops-Emoticons-Setup.exe=>(NSIS o)=>lzma_solid_nsis0004
Détecté avec: Adware.Ncase.D
C:\Documents and Settings\CDehez\Mes documents\Mes images\emoticon\Mnemic-Cyclops-Emoticons-Setup.exe=>(NSIS o)=>lzma_solid_nsis0004
Supprimé
C:\Documents and Settings\CDehez\Mes documents\Mes images\emoticon\Mnemic-Cyclops-Emoticons-Setup.exe=>(NSIS o)
Echec de la mise à jour
C:\Documents and Settings\CDehez\Mes documents\Mes images\emoticon\Mnemic-Pack4-Emoticons-Setup.exe=>(NSIS o)=>lzma_solid_nsis0004
Détecté avec: Adware.Ncase.D
C:\Documents and Settings\CDehez\Mes documents\Mes images\emoticon\Mnemic-Pack4-Emoticons-Setup.exe=>(NSIS o)=>lzma_solid_nsis0004
Supprimé
C:\Documents and Settings\CDehez\Mes documents\Mes images\emoticon\Mnemic-Pack4-Emoticons-Setup.exe=>(NSIS o)
Echec de la mise à jour
E:\nideiect.com
Infecté par: Trojan.Downloader.Bagle.ID
E:\nideiect.com
Supprimé
J'ai également lancé un scan par trendmicro.
Merci
-
-
tes antivirus et spybot marchent?
si c'est pas le cas reinstalle les
et dis tes soucis actuels -
ok les cookies c'est rien
pour les virer regulierement utilise ccleaner
https://www.malekal.com/tutoriel-ccleaner/
bonne continuation
