Virus sur Mp3 Résolu

Question

B'soir a tous, 
J'ai un mp3 Transcend, du genre qu'on peut lire les Vidéo, lire des textes et écouter de la Muzz..Bref...J'ai mit une toune sur mon mp3 et la toune en question passe son temps a se multiplié et prendre la place des autres tounes... Elle a remplacé mes Vidéos par elle même, et remplacé plusieurs chansons.. En plus ... J'ai beau la supprimé, elle reviens, j'ai fait un scans avec Trojan remover, Symantec antivirus et nada ... rien trouvé de méchant... Quand je défile dessus sa dit quelque chose a propse de getpopupinfo  et prend beaucoup de CPU ... Quand je ferme l'application sur Processus, elle reviens en prenant plus de cpu qu'avant ..pour ensuite s'en allé .... 
J'ai cherché un peu sur Google mais personne n'a eu sa avec son mp3.. Sa rapport avec dBpowerAMP mais je m'en suis jamais servit...

Bref... Si vous connaissé une solution, merci d'avance ! :)

InfernO.vir · Accepted Answer

Bonjour,

-Branche ton mp3 sur ton pc mais n'ouvre pas le dossier de ton mp3

-Telecharge flash disinfector-->http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

-Lance Flash Disinfector en double cliquant sur Flash_Disinfector.exe

-Ce n'est pas grave si ton antivirus le detecte, ignore

-Poste le rapport

Mizuka · Answer

Le rapport se save où pas défaut et porte généralement quel nom ? ... j'en 'ai une coupe sur mon systèmes c ..:S

InfernO.vir · Answer

Lorsque tu as passer Flash Disinfector as-tu eu un rapport qui s'est ouvert ds le bloc notes ? si c'est le cas faut le sauvegarder sur le bureau

Mizuka · Answer

Quand je clique sur le programme, bon la page chie un peu mais ça c'est normal , Mon active deskop c'est désactivé .. ça je sais pas si c'est normal... Mais quand tout est revenu ... Aucun rapport. Rien dans bureau, dans le mp3, dans mon  c:/ qui correspond a la date.... Mon mp3 d'ailleurs a l'air a avoir même pas bronché .. Normalement quand kekchose fouille dedans ( un antivirus ou ben une toune qui joue) sur l'écran du mp3, sa se voit ... Mais la .. rien ..

InfernO.vir · Answer

Regarde ici --> https://www.informatruc.com

Mizuka · Answer

Euhh ... J'ai fait exactement la même chose que lui/elle ... Mais voila j'ai le même problème, y veut pas supprimé et pèse 0 Ko .... :-/ ...

InfernO.vir · Answer

On va essayer autrement:

-Télécharge RavAntivirus (d'Evosla) : http://www.evosla.com/files/vir/rav/rav.zip

-Branche les disques amovibles sans les ouvrir avant de lancer le Fix 

-Décompresse l'archive sur le bureau

-Double-cliquer sur RAV.exe pour lancer l'outil

-Une fois RAV ANTIVIRUS lancé, il scannera automatiquement tous les lecteurs susceptibles d'être infectés 

-S'il y a infection un rapport s'établira, sinon le logiciel affichera le message : « Votre Ordinateur est sain » 

-Retirer les disques amovibles et redémarrer l'ordinateur

InfernO.vir · Answer

Comment ca tu l'a formater ?

InfernO.vir · Answer

Ok quel est le probleme du mp3 message d'erreur: "err. format" "incorrect format" ?

InfernO.vir · Answer

AïeAïeAïe, as-tu cd avec le mp3 ?

InfernO.vir · Answer

Alors la je peux pas t'aider ! normalement il faut le brancher-->clique droit sur l'icone du mp3-->proprietes-->formater fat12,fat16 mais pas fat32

InfernO.vir · Answer

a partir d'un des boutons du mp3 ? essaye de le brancher sur l'ordi et formate-le !

Mizuka · Answer

Bon alors voila, j'ai fait le scan et redémarré. Le prog adétecté un virus dans le d:/ .. -_- Mon mp3 c'est le p:/.... Donc j'ai une bebitte de moins de sur mon ordi mais pas celle que je veux :P 

https://www.casimages.com/i/081004060836251642571606.jpg.html

J'ai fait un screenshot de ce qui apparait dans le dossier de mon mp3 ... Donc, une toune à 0 bytes... alors que tout les autres ont un poids normal ( environ 5.47mb...) Il y a encore l'erreur de GetPopUpInfo.exe et prend encore beaucoup de jus .... :S

InfernO.vir · Answer

-Telecharge HiJackThis--> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe dans un dossier.

-Branche ton MP3 mais n'ouvre pas le dossier du MP3

-Double-clique sur HiJackThis.exe puis clique sur "Do a system scan and save a logfile"

-Poste le rapport generer !

Mizuka · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:13, on 10/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.emachines.com/ec/en/US/content/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.emachines.com/ec/en/US/content/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - C:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Hyperappel du Petit Larousse 2008.lnk = C:\Program Files\Larousse\Petit Larousse 2008\bin\Hyperappel.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.emachines.com/ec/en/US/content/home.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://lizard280.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://lizard280.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c8ebbb13ee7db0) (gupdate1c8ebbb13ee7db0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Internet Connection Sharing (SharedAccess) - Unknown owner - C:\WINDOWS\C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

InfernO.vir · Answer

Niang1331 CREER TON PROPRE SUJET !!!! dsl mais si tu ne le fais pas et que tu continue a poster ici = 

alerte aux moderateurs !

J'avais pas vu que c'etait une autre personne qui avait pris ta place mizuka !!dsl fait le scan hijackthis au message n°=19

InfernO.vir · Answer

tu na pas brancher ton mp3

InfernO.vir · Answer

-Telecharge combofix--> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-Desactive tes protections residentes ferme tout tes programme et deconnecte toi

-Debranche et rebranche ton MP3

-Lance combofix

-Laisse le faire ne touche a rien

-Poste moi le rapport


PS: il peut te demander de redemarer ton pc, dans ce cas fait le !

niang1331 · Answer

j'ai créé le mien mais personne me répond et je droyais que tu parlé a moi

InfernO.vir · Answer

Ba je n'ais pas fait gaffe a qui je parlais donc reste sur ton sujet tu auras forcement une reponse !

Mizuka · Answer

Bon voila, j'ai tout fermé, laissé mon ordi faire squi fallait, sa redémarré tout seul et sa donne sa...
Et voila les tounes laite sont plus la 0_0 .... J'ouvre mon mp3 et puis piouhh plus une toune de virus ... J'comprend pas vraiment pourquoi en faite ... Le rapport parle pas du tout du lecteur P:/ et tout est arrangé ... Mais vraiment jte dit merci d'avoir tout pris ce temps pour moi :) ! Sans toi/vous, sa aurait tout bouffé mon mp3 .. ( sa l'avait même mangé mes south park :( ..)

(la next time que je vais rebooté l'ordi... mon firefox va t'il remarché? ... il est en mode sans échec sans raison .... )

ComboFix 08-10-04.01 - Owner 2008-10-04 12:38:46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.412 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\Téléchargement\ComboFix.exe
* Created a new restore point

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
C:\Documents and Settings\All Users\Application Data\SeekmoSA
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA.dat
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA_kyf_update.dat
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAau.dat
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht
C:\Documents and Settings\Owner\Application Data\inst.exe
C:\Documents and Settings\Owner\Application Data\Seekmo
C:\Documents and Settings\Owner\Local Settings\Application Data\ydvkdvlxdf.dat
C:\Documents and Settings\Owner\Local Settings\Application Data\ydvkdvlxdf_nav.dat
C:\Documents and Settings\Owner\Local Settings\Application Data\ydvkdvlxdf_navps.dat
C:\WINDOWS\config.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MCHINJDRV

((((((((((((((((((((((((( Files Created from 2008-09-04 to 2008-10-04 )))))))))))))))))))))))))))))))
.

2008-09-19 22:12 . 2008-09-19 22:12 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Media Player Classic
2008-09-17 16:56 . 2007-09-04 12:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll
2008-09-17 16:55 . 2008-09-17 16:55 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-17 16:55 . 2008-09-17 16:55 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-09-17 16:55 . 2008-09-17 16:55 <DIR> d-------- C:\Program Files\AML Products
2008-09-17 16:55 . 2008-07-30 15:09 38 --a------ C:\WINDOWS\avisplitter.ini
2008-09-17 16:46 . 2008-09-17 16:46 <DIR> d-------- C:\videooutput
2008-09-15 19:06 . 2008-09-21 20:15 <DIR> d-------- C:\.mtvconvertertmp
2008-09-15 19:03 . 2008-09-15 19:03 <DIR> d-------- C:\Program Files\QT Lite
2008-09-15 19:03 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-09-15 19:03 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-09-13 14:01 . 2008-09-13 14:02 <DIR> d-------- C:\Program Files\DivX
2008-09-13 13:58 . 2008-09-13 13:58 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2008-09-13 13:51 . 2008-09-13 13:51 <DIR> d-------- C:\SlideShow
2008-09-13 13:51 . 2008-09-13 13:51 <DIR> d-------- C:\Program Files\Transcend
2008-09-13 13:51 . 2008-09-13 13:51 <DIR> d-------- C:\MTVConverter
2008-09-11 22:01 . 2008-09-11 22:04 <DIR> d-------- C:\Program Files\Winamp
2008-09-11 22:01 . 2008-09-11 22:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Winamp
2008-09-07 22:30 . 2008-09-07 22:30 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\.Tribler
2008-09-07 22:30 . 2008-09-07 22:30 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\.SwarmPlayer
2008-09-07 22:24 . 2008-09-07 22:30 <DIR> d-------- C:\Program Files\SwarmPlayer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-04 16:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\uTorrent
2008-10-04 16:56 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-10-03 22:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\mIRC
2008-10-03 22:51 --------- d-----w C:\Program Files\mIRC
2008-10-03 00:41 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-02 22:07 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft
2008-10-02 03:20 --------- d-----w C:\Program Files\Google
2008-09-15 23:03 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-09-15 23:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-11 23:23 --------- d-----w C:\Program Files\LimeWire
2008-09-10 07:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-05 22:58 234,778 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2008-08-31 04:13 --------- d-----w C:\Documents and Settings\Owner\Application Data\gtk-2.0
2008-08-26 17:45 606,848 ----a-w C:\WINDOWS\flashax.exe
2008-08-26 17:45 503,808 ----a-w C:\WINDOWS\The Cow Cult.scr
2008-08-26 17:45 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-08-26 17:43 587,725 ----a-w C:\WINDOWS\bad_kitty.exe
2008-08-26 17:43 40,960 ----a-w C:\WINDOWS\bad_kitty.dll
2008-08-26 17:43 231,328 ----a-w C:\WINDOWS\bad_kitty.scr
2008-08-25 16:04 --------- d-----w C:\Program Files\StepMania
2008-08-18 04:03 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
2008-08-11 20:18 --------- d-----w C:\Program Files\UBISOFT
2008-08-06 16:16 --------- d-----w C:\Program Files\Free Audio Pack
2008-08-06 15:47 --------- d-----w C:\Program Files\LitexMedia
2008-08-06 05:15 --------- d-----w C:\Program Files\Trojan Remover
2008-08-06 05:07 --------- d-----w C:\Documents and Settings\Owner\Application Data\Simply Super Software
2008-08-06 05:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-08-06 03:46 --------- d-----w C:\Program Files\GoPets Ltd
2008-08-06 03:33 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Micro Application
2008-08-05 16:29 --------- d-----w C:\Documents and Settings\Owner\Application Data\Micro Application
2008-08-05 16:25 --------- d-----w C:\Program Files\Micro Application
2008-08-05 16:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-05 16:18 --------- d-----w C:\Program Files\sixteen tons entertainment
2008-04-27 05:37 204 ----a-w C:\Program Files\2UV0HQ86.bat
2007-05-25 20:09 47,360 ----a-w C:\Documents and Settings\Owner\Application Data\pcouffin.sys
2007-01-16 23:23 0 -c--a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2004-08-04 19:00 94,784 -csh--w C:\WINDOWS\twain.dll
2004-08-04 19:00 50,688 -csh--w C:\WINDOWS\twain_32.dll
2004-08-04 19:00 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-04 19:00 54,784 --sh--w C:\WINDOWS\system32\msvcirt.dll
2007-12-04 18:38 550,912 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-04 19:00 83,456 --sh--w C:\WINDOWS\system32\olepro32.dll
2004-08-04 19:00 11,776 --sh--w C:\WINDOWS\system32\regsvr32.exe
.

------- Sigcheck -------

2007-06-13 06:23 975360 9784e0719124e4a23989aef9e7ca02d6 C:\WINDOWS\explorer.exe
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\explorer.exe
2007-06-13 06:23 975360 9784e0719124e4a23989aef9e7ca02d6 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-01-29 219952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 135168]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-11-14 125536]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-09-18 7204864]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-09 185632]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 289064]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-07-15 878672]
"nwiz"="nwiz.exe" [2005-09-18 C:\WINDOWS\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-14 C:\WINDOWS\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.msrt24"= msrt24.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-07-10 09:47 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-10 10:51 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-07-30 17:17 21738792 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Documents and Settings\\Owner\\Desktop\\Bureau\\msnmsgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 302000]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 72624]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 1234480]
S2 gupdate1c8ebbb13ee7db0;Google Update Service (gupdate1c8ebbb13ee7db0);C:\Program Files\Google\Update\GoogleUpdate.exe [2008-08-28 133104]
S3 SynasUSB;SynasUSB;C:\WINDOWS\system32\drivers\SynasUSB.sys [ ]
.
Contents of the 'Scheduled Tasks' folder

2008-10-04 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2008-08-28 19:45]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
MSConfigStartUp-QuickTime Task - C:\Program Files\QuickTime\QTTask.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\7lexd6zl.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.torrent411.com/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-04 12:54:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Larousse\Petit Larousse 2008\bin\Hyperappel.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-10-04 13:12:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-04 17:12:20
ComboFix2.txt 2007-08-07 21:06:56

Pre-Run: 944,648,192 bytes free
Post-Run: 1,140,293,632 bytes free

210 --- E O F --- 2008-09-10 07:05:56

Mizuka · Answer

Et puis j'ai trouvé ca sur mon mp3 :) Sa veut dire que c'est vraiment réglé non ? :D


Checking file system on P:
The type of the file system is FAT32.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                         
Volume Serial Number is FCA6-B1F7
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
Removing nonvalid long folder entry from \Lisa...
\Lisa\Aerosmith - Kings And Queens.mp3  first allocation unit is not valid. The entry will be truncated.
Convert lost chains to files (Y/N)? Yes
1648520 KB in 46 recovered files.
Windows has made corrections to the file system.
      8166288 KB total disk space.
         1804 KB in 187 hidden files.
          360 KB in 80 folders.
      7239500 KB in 886 files.
       924620 KB are available.

         4096 bytes in each allocation unit.
      2041572 total allocation units on disk.
       231155 allocation units available on disk.

InfernO.vir · Answer

Ok il y a du menage de fait !

-Telecharge otmoveit2--> http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

-Sauvegarde le sur ton Bureau.

-Double-Clique sur OTMoveIt.exe pour le lancer.

-Copie le chemin des fichiers suivants en selectionnant TOUT et en appuyant sur CTRL+C (ou, après avoir sélectionner, clique-droit et choisis Copier) :

Legacy_MCHINJDRV 


-Retourne dans OTMoveit, fais un clique-droit dans la fenêtre "Paste List of Files/Folders to be moved" et choisis Coller.

-Clique sur le bouton rouge Moveit!.

-Ferme OTMoveIt.


Note : Si un fichier ou un dossier ne peut être déplacer immédiatement il te sera demander de redémarrer ta machine pour finir le processus. Si c'est le cas, choisis Yes.

Poste nous le rapport de OTMoveIT dispo ici : C:\_OTMoveIt\MovedFiles

InfernO.vir · Answer

Demarrer--executer-->regedit-->navigue jusqu'a cette clé: 

[-HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_MCHINJDRV

InfernO.vir · Answer

Tant c'est une bonne nouvelle !

InfernO.vir · Answer

Slt,

LoL merci de ton respect envers moi, @+ bon surf !

Virus sur Mp3

26 réponses

Discussions similaires

Newsletters