Virus Rootkit - Page 3

c'est fait j'ai enregistré le rapport et j'ai redemaré !

salut

désoler pour le silence

ton antivirus te détecte toujours ton fichier ?

oui il me le detecte toujours !

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous :

:Processes
explorer.exe
Services :

:Files
C:\WINDOWS\system32\ati2cqa.dll

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

voila dans result se que sa me marque :

========== PROCESSES ==========
Process explorer.exe killed successfully.
Unable to kill process: Services :
========== FILES ==========
LoadLibrary failed for C:\WINDOWS\system32\ati2cqa.dll
C:\WINDOWS\system32\ati2cqa.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ati2cqa.dll scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Damien\LOCALS~1\Temp\Perflib_Perfdata_6cc.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Damien\LOCALS~1\Temp\zgbzoyoz.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Damien\LOCALS~1\Temp\~DF3439.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Damien\LOCALS~1\Temp\~DF4852.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Damien\LOCALS~1\Temp\~DF4864.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Damien\LOCALS~1\Temp\~DF540A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Damien\LOCALS~1\Temp\~DF541C.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5cc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12192008_222015

Salut

● Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

● Double clique sur RSIT.exe pour lancer l'outil.

● Clique sur ' continue ' à l'écran Disclaimer.
● Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

● Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )