Infecté par trojanproxy:win32/mitglieder.gen!

Résolu
olive71 -  
bonjour a tous,

depuis une 15éme de jours je suis infecté par trojanproxy:win32/mitglieder.gen!A , virtool:winNT/higlieder.gen!A et worm:win32/bagle.ABM sans pouvoir les supprimer.
je viens de m'appercevoir que je ne reçoi plus d'email ...
merci d'avance pour votre aide
Configuration: Windows XP
Internet Explorer 7.0

10 réponses

  2. barbech
    salut !!aider moi SVP !!
    mon PC est infecté par trojan.win32.monder.qen !!j'ai pa pu le supprimer avec Kaspersky !!
    comment faire pour le supprimer ??

    merci pour votre aide !!!
    2. Regis59 Contributeur sécurité
      Salut

      Ou en sont tes soucis?

      A+
      1. olive711
        salut,

        ça semble etre bon.

        mon antivirus ne detecte plus rien dangereux

        merci encore
    4. Regis59 Contributeur sécurité
      Salut,

      Tu peux copier coller le rapport en entier?

      A+
      1. olive711
        salut,
        BitDefender Online Scanner

        Scan report generated at: Thu, Mar 22, 2007 - 21:57:16

        Scan path: C:\;D:\;

        Statistics

        Time
        01:22:58

        Files
        277211

        Folders
        4641

        Boot Sectors
        3

        Archives
        7536

        Packed Files
        19612

        Results

        Identified Viruses
        2

        Infected Files
        31

        Suspect Files
        0

        Warnings
        0

        Disinfected
        0

        Deleted Files
        31

        Engines Info

        Virus Definitions
        406682

        Engine build
        AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)

        Scan plugins
        14

        Archive plugins
        38

        Unpack plugins
        6

        E-mail plugins
        6

        System plugins
        1

        Scan Settings

        First Action
        Disinfect

        Second Action
        Delete

        Heuristics
        Yes

        Enable Warnings
        Yes

        Scanned Extensions
        *;

        Exclude Extensions

        Scan Emails
        Yes

        Scan Archives
        Yes

        Scan Packed
        Yes

        Scan Files
        Yes

        Scan Boot
        Yes

        Scanned File
        Status

        C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.29
        Infected with: Trojan.Downloader.Bagle.CD

        C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.29
        Disinfection failed

        C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.29
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0001587.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0001587.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0001587.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0002587.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0002587.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0002587.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0003587.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0003587.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0003587.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0004588.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0004588.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0004588.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0005587.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0005587.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0005587.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0006587.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0006587.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0006587.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0007591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0007591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0007591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0008591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0008591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0008591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0009591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0009591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0009591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0010591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0010591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0010591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0011591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0011591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0011591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0012591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0012591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0012591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0013592.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0013592.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0013592.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0014591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0014591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0014591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0015591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0015591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0015591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0016591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0016591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0016591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0017591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0017591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0017591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0018592.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0018592.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0018592.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0019592.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0019592.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0019592.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0020592.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0020592.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0020592.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0021591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0021591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0021591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0022591.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0022591.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP29\A0022591.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023596.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023596.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023596.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023685.exe
        Infected with: Trojan.Downloader.Bagle.CD

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023685.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023685.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023687.exe
        Infected with: Trojan.Downloader.Bagle.CD

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023687.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP30\A0023687.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP32\A0024429.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP32\A0024429.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP32\A0024429.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP35\A0024784.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP35\A0024784.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP35\A0024784.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP49\A0025098.exe
        Infected with: Worm.Bagle.B

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP49\A0025098.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP49\A0025098.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP49\A0025122.exe
        Infected with: Trojan.Downloader.Bagle.CD

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP49\A0025122.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP49\A0025122.exe
        Deleted

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP51\A0025220.exe
        Infected with: Trojan.Downloader.Bagle.CD

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP51\A0025220.exe
        Disinfection failed

        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP51\A0025220.exe
        Deleted

        a+
    5. olive711
      salut,
      BitDefender Online Scanner - Real Time Virus Report

      Generated at: Thu, Mar 22, 2007 - 22:23:36

      --------------------------------------------------------------------------------

      Scan Info

      Scanned Files
      278664

      Infected Files
      31

      Virus Detected

      Worm.Bagle.B
      26

      Trojan.Downloader.Bagle.CD
      5

      --------------------------------------------------------------------------------

      This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.

      a+
      1. Regis59 Contributeur sécurité
        Salut,

        Lance ce scan en ligne:
        http://www.bitdefender.fr/scan8/ie.html
        Copie/colle le rapport
        Aide en image : http://pageperso.aol.fr/rginformatique/mapage/defender.htm

        A+
        1. Regis59 Contributeur sécurité
          Salut

          Remet un HijackThis.

          a+
          1. olive711
            salut

            Logfile of HijackThis v1.99.1
            Scan saved at 21:18:56, on 21/03/2007
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16414)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\WINDOWS\Explorer.EXE
            C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
            c:\APPS\HIDSERVICE\HIDSERVICE.exe
            C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            C:\WINDOWS\system32\svchost.exe
            c:\APPS\Powercinema\Kernel\TV\CLSched.exe
            C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
            C:\WINDOWS\system32\VTtrayp.exe
            C:\Program Files\Microsoft Windows OneCare Live\winss.exe
            C:\WINDOWS\system32\VTTimer.exe
            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
            C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
            C:\WINDOWS\SOUNDMAN.EXE
            C:\Apps\Powercinema\PCMService.exe
            C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
            C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
            C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\A.C\Scroll-In-Mouse V2.0\Scroll.exe
            C:\Documents and Settings\christelle\Mes documents\Mes Documents\olivier\eMule0.47c\eMule0.47c\emule.exe
            C:\Program Files\Internet Explorer\IEXPLORE.EXE
            C:\Documents and Settings\christelle\Bureau\HijackThis.exe

            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
            O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
            O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
            O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
            O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe"
            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
            O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
            O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
            O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
            O4 - HKLM\..\Run: [InstantAccess] "C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" /h
            O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
            O4 - HKLM\..\Run: [Easy-PrintToolBox] "C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" /logon
            O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SPF\smc.exe" -startgui
            O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
            O4 - HKLM\..\Run: [OoPDFSettingsv6.exe] C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
            O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
            O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
            O4 - Global Startup: Scroll-In-Mouse V2.0.lnk = C:\Program Files\A.C\Scroll-In-Mouse V2.0\Scroll.exe
            O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
            O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
            O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
            O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O11 - Options group: [INTERNATIONAL] International*
            O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
            O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - https://www.pixum.fr/?p_ref=crm_umleitung_photoreflex_1113
            O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - file://C:\DRIVERS\snapsys\HDDDiag\bin\npseatools.cab
            O18 - Protocol: cdefs - {B5F329B4-2BBD-48F5-ADAF-9EAF2AFE37B3} - C:\Program Files\Anuman Interactive\Train électrique 3D\monki.dll
            O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
            O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
            O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
            O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
            O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
            O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
            O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
            O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
            O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        2. Regis59 Contributeur sécurité
          Salut,

          Rends toi sur ce site :
          http://www.zonavirus.com/datos/descargas/95/elibagla.asp
          tout en bas de cette page tu trouveras un outil
          à télécharger,clique sur escargar Elibagla 10.28
          installe ce fichier sur le bureau.
          ensuite double-clic sur Elibagla.exe
          >laisse la case "eliminar ficheros automaticamente" coché
          >clique sur"explorar"
          >laisse-le travailler
          >poste le rapport final qui sera dans c:\infosat.txt
          1. olive71
            salut

            voila le rapport et surtout merci

            Mon Mar 19 20:23:28 2007
            EliBagle v10.29 (c)2007 S.G.H. / Satinfo S.L.
            ----------------------------------------------
            Lista de Acciones (por Acción Directa):
            C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
            Por favor, envienos una muestra del fichero
            C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.29
            a "virus@satinfo.es". Gracias.
            C:\WINDOWS\SYSTEM32\HLDRRR.EXE --> Eliminado Bagle
            Eliminada Carpeta "%WinDir%\exefld"
            Eliminada Carpeta "%AppData%\Hidires"
            Restaurada Clave: "SafeBoot\Minimal y Network"

            Mon Mar 19 20:24:02 2007
            EliBagle v10.29 (c)2007 S.G.H. / Satinfo S.L.
            ----------------------------------------------
            Lista de Acciones (por Exploración):
            Explorando Unidad C:\
        3. olive71
          pour plus d'info voici mon hijackthis
          Logfile of HijackThis v1.99.1
          Scan saved at 17:19:45, on 18/03/2007
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16414)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
          c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
          c:\APPS\HIDSERVICE\HIDSERVICE.exe
          C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
          C:\Program Files\Microsoft Windows OneCare Live\winss.exe
          c:\APPS\Powercinema\Kernel\TV\CLSched.exe
          C:\WINDOWS\system32\VTtrayp.exe
          C:\WINDOWS\system32\VTTimer.exe
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
          C:\WINDOWS\SOUNDMAN.EXE
          C:\Apps\Powercinema\PCMService.exe
          C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
          C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
          C:\WINDOWS\system32\hldrrr.exe
          C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\WINDOWS\system32\hldrrr.exe
          C:\Program Files\A.C\Scroll-In-Mouse V2.0\Scroll.exe
          C:\APPS\RecordNow\RecordNow.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Documents and Settings\christelle\Bureau\HijackThis.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
          O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
          O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
          O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe"
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
          O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
          O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
          O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
          O4 - HKLM\..\Run: [InstantAccess] "C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" /h
          O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
          O4 - HKLM\..\Run: [Easy-PrintToolBox] "C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" /logon
          O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SPF\smc.exe" -startgui
          O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
          O4 - HKLM\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
          O4 - HKLM\..\Run: [OoPDFSettingsv6.exe] C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
          O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
          O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
          O4 - HKCU\..\Run: [drvsyskit] C:\Documents and Settings\christelle\Application Data\hidires\hidr.exe
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O4 - Global Startup: Scroll-In-Mouse V2.0.lnk = C:\Program Files\A.C\Scroll-In-Mouse V2.0\Scroll.exe
          O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
          O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
          O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
          O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O11 - Options group: [INTERNATIONAL] International*
          O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
          O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - https://www.pixum.fr/?p_ref=crm_umleitung_photoreflex_1113
          O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - file://C:\DRIVERS\snapsys\HDDDiag\bin\npseatools.cab
          O18 - Protocol: cdefs - {B5F329B4-2BBD-48F5-ADAF-9EAF2AFE37B3} - C:\Program Files\Anuman Interactive\Train électrique 3D\monki.dll
          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
          O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
          O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
          O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
          O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
          O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
          O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
          O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
          O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
          O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

          Discussions similaires

          Infecte par un virus
          sapard

          3 réponses
          Mon ordinateur a été infecté par un virus ou
          henry4002

          6 réponses
          infecté par InstantAccess
          mimi22

          22 réponses
          infecté par brontok
          yannick

          27 réponses
          infecté par trojan.generic
          blocage

          29 réponses