Bagle virus conseil rapport findYKill
Bonjour,
Mon PC (XP - SP2) héberge un virus de type bagle (il me semble après lecture des échange et autodiagnostic).
J'ai essayé moulte choses pour le supprimer mais rien à faire )-:
Après instalation de FindyKill voici le rapport ci joint.
Puis je passer à la l'option 2 ?
Pouvez vous m'aider svp
Merci d'avance.
----------------- FindyKill V4.707 ------------------
* User : Administrateur - IND_PC
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 06/12/08 par Chiquitine29
* Recherche effectuée à 19:39:00 le 07/12/2008
* Windows XP - Internet Explorer 6.0.2900.2180
((((((((((((((((( *** Recherche *** ))))))))))))))))))
--------------- [ Processus actifs ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\Launcher.exe
C:\WINDOWS\RaUI.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\WINDOWS\System32\svchost.exe
--------------- [ Fichiers/Dossiers infectieux ] ----------------
»»»» Presence des fichiers dans C:
»»»» Presence des fichiers dans C:\WINDOWS
»»»» Presence des fichiers dans C:\WINDOWS\Prefetch
Found ! - C:\WINDOWS\prefetch\101156.EXE-173E0A88.pf
Found ! - C:\WINDOWS\prefetch\105625.EXE-2EE6E78F.pf
Found ! - C:\WINDOWS\prefetch\110703.EXE-127FE0FF.pf
Found ! - C:\WINDOWS\prefetch\115859.EXE-05CB3151.pf
Found ! - C:\WINDOWS\prefetch\123500.EXE-078FE014.pf
Found ! - C:\WINDOWS\prefetch\126531.EXE-3A1356B3.pf
Found ! - C:\WINDOWS\prefetch\129234.EXE-29B74FB9.pf
Found ! - C:\WINDOWS\prefetch\14685796.EXE-32B0DDDA.pf
Found ! - C:\WINDOWS\prefetch\14724890.EXE-1462FC07.pf
Found ! - C:\WINDOWS\prefetch\14729593.EXE-0DAADEF6.pf
Found ! - C:\WINDOWS\prefetch\14735593.EXE-28828198.pf
Found ! - C:\WINDOWS\prefetch\164203.EXE-1F87C02C.pf
Found ! - C:\WINDOWS\prefetch\232984.EXE-01EE2E69.pf
Found ! - C:\WINDOWS\prefetch\454906.EXE-34698E89.pf
Found ! - C:\WINDOWS\prefetch\466218.EXE-3761432F.pf
Found ! - C:\WINDOWS\prefetch\53687.EXE-2E0E0280.pf
Found ! - C:\WINDOWS\prefetch\550406.EXE-323719D0.pf
Found ! - C:\WINDOWS\prefetch\58296.EXE-38C81240.pf
Found ! - C:\WINDOWS\prefetch\59199265.EXE-33C2DE38.pf
Found ! - C:\WINDOWS\prefetch\73851062.EXE-337EA1C5.pf
Found ! - C:\WINDOWS\prefetch\73953625.EXE-095CCEC4.pf
Found ! - C:\WINDOWS\prefetch\73987093.EXE-0D866190.pf
Found ! - C:\WINDOWS\prefetch\74016593.EXE-270466EA.pf
Found ! - C:\WINDOWS\prefetch\76000.EXE-08FF1311.pf
Found ! - C:\WINDOWS\prefetch\76296.EXE-3ACD2597.pf
Found ! - C:\WINDOWS\prefetch\81593.EXE-2351EB06.pf
Found ! - C:\WINDOWS\prefetch\88328.EXE-273432E1.pf
Found ! - C:\WINDOWS\prefetch\89343.EXE-35435527.pf
Found ! - C:\WINDOWS\prefetch\91875.EXE-050204EA.pf
Found ! - C:\WINDOWS\prefetch\99218.EXE-00041CAA.pf
Found ! - C:\WINDOWS\prefetch\99765.EXE-1FCEA77F.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-0695BA6E.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Found ! - C:\WINDOWS\prefetch\WINFILSE.EXE-17C2CF68.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
»»»» Presence des fichiers dans C:\WINDOWS\system32
Found ! [07/12/2008 18:59] - C:\WINDOWS\system32\mdelk.exe
Found ! [07/12/2008 18:22] - C:\WINDOWS\system32\ban_list.txt
»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers
Found ! [07/12/2008 18:58] - C:\WINDOWS\system32\drivers\srosa.sys
Found ! [07/12/2008 18:58] - C:\WINDOWS\system32\drivers\srosa2.sys
Found ! [05/07/2004 07:02] - C:\WINDOWS\system32\drivers\winfilse.exe
Found ! [07/12/2008 19:00] - "C:\WINDOWS\system32\drivers\downld"
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\123500.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\141328.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\146781.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\180625.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\191296.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\39203.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\55031.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\56656.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\76000.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\81593.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\91875.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\94531.exe
»»»» Presence des fichiers dans C:\Documents and Settings\Administrateur\Application Data
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\flec006.exe"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\list.oct"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\data.oct"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\srvlist.oct"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\shared"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m"
»»»» Presence des fichiers dans C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\PC-cillin v9.05\program files\Trend Micro\PC-cillin\Patch.exe
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\PC-cillin v9.05\program files\Trend Micro\PC-cillin\PATCHW32.DLL
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\Patch.exe
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\patchbld.dll
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\PATCHW32.DLL
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\Serial.htm
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\serialnb.bmp
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\TMAS\auhome\patch.exe
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\TMAS\auhome\PATCHW32.DLL
»»»» Presence des fichiers dans C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5
Found ! [04/12/2008 20:48] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[1].jpg
Found ! [04/12/2008 20:53] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[2].jpg
Found ! [07/12/2008 10:24] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[3].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[4].jpg
Found ! [07/12/2008 10:24] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64_1[1].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64_3[1].jpg
Found ! [07/12/2008 16:30] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64_3[2].jpg
Found ! [04/12/2008 20:48] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\mxd[1].jpg
Found ! [07/12/2008 17:23] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\mxd[2].jpg
Found ! [07/12/2008 16:30] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64[1].jpg
Found ! [07/12/2008 17:22] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64[2].jpg
Found ! [06/12/2008 15:06] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_1[1].jpg
Found ! [07/12/2008 10:25] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_2[1].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_2[2].jpg
Found ! [04/12/2008 20:51] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_3[1].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_3[2].jpg
Found ! [07/12/2008 10:26] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\mxd[1].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64[1].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64[2].jpg
Found ! [04/12/2008 20:51] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_1[1].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_1[2].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_2[1].jpg
Found ! [07/12/2008 16:30] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_2[2].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_3[1].jpg
Found ! [07/12/2008 17:21] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_3[2].jpg
Found ! [07/12/2008 14:29] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\mxd[1].jpg
Found ! [04/12/2008 20:52] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64[1].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64[2].jpg
Found ! [04/12/2008 20:47] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_1[1].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_3[1].jpg
Found ! [07/12/2008 10:24] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_3[2].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_3[3].jpg
Found ! [07/12/2008 16:31] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\mxd[1].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\mxd[2].jpg
Found ! [16/08/2007 09:50] - C:\Documents and Settings\Invit‚\Local Settings\Temporary Internet Files\Content.IE5\46IUOXJ4\F22A882BB64228F6352C58F4C2852[2].jpg
--------------- [ Registre / Startup ] ----------------
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe
HPDJ Taskbar Utility=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
PrimaLauncher=C:\WINDOWS\system32\Launcher.exe
NVMixerTray="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
NeroCheck=C:\WINDOWS\system32\NeroCheck.exe
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\KeyMaestro=
RepeatFlag=0 (0x0)
PowerEnable=0 (0x0)
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
[HKEY_CURRENT_USER\software\local appwizard-generated applications\flec006]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\qttask]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winfilse]
--------------- [ Registre / Clés infectieuses ] ----------------
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\Local AppWizard-Generated Applications\flec006
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\FirtR
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\flec006
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S
--------------- [ Etat / Services ] ----------------
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
- sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
- sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
- sans echec non fonctionnel !!
+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - Type de démarrage = 4
/!\ Ip6Fw - Type de démarrage = 4
/!\ SharedAccess - Type de démarrage = 4
/!\ wuauserv - Type de démarrage = 4
/!\ wscsvc - Type de démarrage = 4
--------------- [ Recherche dans supports amovibles] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur de CD-ROM
+- Contenu de l'autorun : D:\autorun.inf
[autorun]
OPEN=autoplay.exe
ICON=setup\media\tpta.ico
TITLEBAR=TreasureArcade
+- presence des fichiers :
Found ! [20/06/2002 19:17][-r-------] - D:\autorun.inf
--------------- [ Registre / Mountpoint2 ] ----------------
-> Not found !
------------------- ! Fin du rapport ! --------------------
Mon PC (XP - SP2) héberge un virus de type bagle (il me semble après lecture des échange et autodiagnostic).
J'ai essayé moulte choses pour le supprimer mais rien à faire )-:
Après instalation de FindyKill voici le rapport ci joint.
Puis je passer à la l'option 2 ?
Pouvez vous m'aider svp
Merci d'avance.
----------------- FindyKill V4.707 ------------------
* User : Administrateur - IND_PC
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 06/12/08 par Chiquitine29
* Recherche effectuée à 19:39:00 le 07/12/2008
* Windows XP - Internet Explorer 6.0.2900.2180
((((((((((((((((( *** Recherche *** ))))))))))))))))))
--------------- [ Processus actifs ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\Launcher.exe
C:\WINDOWS\RaUI.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\WINDOWS\System32\svchost.exe
--------------- [ Fichiers/Dossiers infectieux ] ----------------
»»»» Presence des fichiers dans C:
»»»» Presence des fichiers dans C:\WINDOWS
»»»» Presence des fichiers dans C:\WINDOWS\Prefetch
Found ! - C:\WINDOWS\prefetch\101156.EXE-173E0A88.pf
Found ! - C:\WINDOWS\prefetch\105625.EXE-2EE6E78F.pf
Found ! - C:\WINDOWS\prefetch\110703.EXE-127FE0FF.pf
Found ! - C:\WINDOWS\prefetch\115859.EXE-05CB3151.pf
Found ! - C:\WINDOWS\prefetch\123500.EXE-078FE014.pf
Found ! - C:\WINDOWS\prefetch\126531.EXE-3A1356B3.pf
Found ! - C:\WINDOWS\prefetch\129234.EXE-29B74FB9.pf
Found ! - C:\WINDOWS\prefetch\14685796.EXE-32B0DDDA.pf
Found ! - C:\WINDOWS\prefetch\14724890.EXE-1462FC07.pf
Found ! - C:\WINDOWS\prefetch\14729593.EXE-0DAADEF6.pf
Found ! - C:\WINDOWS\prefetch\14735593.EXE-28828198.pf
Found ! - C:\WINDOWS\prefetch\164203.EXE-1F87C02C.pf
Found ! - C:\WINDOWS\prefetch\232984.EXE-01EE2E69.pf
Found ! - C:\WINDOWS\prefetch\454906.EXE-34698E89.pf
Found ! - C:\WINDOWS\prefetch\466218.EXE-3761432F.pf
Found ! - C:\WINDOWS\prefetch\53687.EXE-2E0E0280.pf
Found ! - C:\WINDOWS\prefetch\550406.EXE-323719D0.pf
Found ! - C:\WINDOWS\prefetch\58296.EXE-38C81240.pf
Found ! - C:\WINDOWS\prefetch\59199265.EXE-33C2DE38.pf
Found ! - C:\WINDOWS\prefetch\73851062.EXE-337EA1C5.pf
Found ! - C:\WINDOWS\prefetch\73953625.EXE-095CCEC4.pf
Found ! - C:\WINDOWS\prefetch\73987093.EXE-0D866190.pf
Found ! - C:\WINDOWS\prefetch\74016593.EXE-270466EA.pf
Found ! - C:\WINDOWS\prefetch\76000.EXE-08FF1311.pf
Found ! - C:\WINDOWS\prefetch\76296.EXE-3ACD2597.pf
Found ! - C:\WINDOWS\prefetch\81593.EXE-2351EB06.pf
Found ! - C:\WINDOWS\prefetch\88328.EXE-273432E1.pf
Found ! - C:\WINDOWS\prefetch\89343.EXE-35435527.pf
Found ! - C:\WINDOWS\prefetch\91875.EXE-050204EA.pf
Found ! - C:\WINDOWS\prefetch\99218.EXE-00041CAA.pf
Found ! - C:\WINDOWS\prefetch\99765.EXE-1FCEA77F.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-0695BA6E.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Found ! - C:\WINDOWS\prefetch\WINFILSE.EXE-17C2CF68.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
»»»» Presence des fichiers dans C:\WINDOWS\system32
Found ! [07/12/2008 18:59] - C:\WINDOWS\system32\mdelk.exe
Found ! [07/12/2008 18:22] - C:\WINDOWS\system32\ban_list.txt
»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers
Found ! [07/12/2008 18:58] - C:\WINDOWS\system32\drivers\srosa.sys
Found ! [07/12/2008 18:58] - C:\WINDOWS\system32\drivers\srosa2.sys
Found ! [05/07/2004 07:02] - C:\WINDOWS\system32\drivers\winfilse.exe
Found ! [07/12/2008 19:00] - "C:\WINDOWS\system32\drivers\downld"
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\123500.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\141328.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\146781.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\180625.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\191296.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\39203.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\55031.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\56656.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\76000.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\81593.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\91875.exe
Found ! [07/12/2008 19:00] - C:\WINDOWS\system32\drivers\downld\94531.exe
»»»» Presence des fichiers dans C:\Documents and Settings\Administrateur\Application Data
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\flec006.exe"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\list.oct"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\data.oct"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\srvlist.oct"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m\shared"
Found ! [07/12/2008 18:59] - "C:\Documents and Settings\Administrateur\Application Data\m"
»»»» Presence des fichiers dans C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\PC-cillin v9.05\program files\Trend Micro\PC-cillin\Patch.exe
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\PC-cillin v9.05\program files\Trend Micro\PC-cillin\PATCHW32.DLL
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\Patch.exe
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\patchbld.dll
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\PATCHW32.DLL
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\Serial.htm
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\serialnb.bmp
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\TMAS\auhome\patch.exe
Found ! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIS\Module\TMAS\auhome\PATCHW32.DLL
»»»» Presence des fichiers dans C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5
Found ! [04/12/2008 20:48] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[1].jpg
Found ! [04/12/2008 20:53] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[2].jpg
Found ! [07/12/2008 10:24] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[3].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64[4].jpg
Found ! [07/12/2008 10:24] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64_1[1].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64_3[1].jpg
Found ! [07/12/2008 16:30] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\b64_3[2].jpg
Found ! [04/12/2008 20:48] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\mxd[1].jpg
Found ! [07/12/2008 17:23] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0G0AQFDO\mxd[2].jpg
Found ! [07/12/2008 16:30] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64[1].jpg
Found ! [07/12/2008 17:22] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64[2].jpg
Found ! [06/12/2008 15:06] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_1[1].jpg
Found ! [07/12/2008 10:25] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_2[1].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_2[2].jpg
Found ! [04/12/2008 20:51] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_3[1].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\b64_3[2].jpg
Found ! [07/12/2008 10:26] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2BKL6FXV\mxd[1].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64[1].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64[2].jpg
Found ! [04/12/2008 20:51] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_1[1].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_1[2].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_2[1].jpg
Found ! [07/12/2008 16:30] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_2[2].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_3[1].jpg
Found ! [07/12/2008 17:21] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\b64_3[2].jpg
Found ! [07/12/2008 14:29] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\8FP0C0QG\mxd[1].jpg
Found ! [04/12/2008 20:52] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64[1].jpg
Found ! [07/12/2008 14:28] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64[2].jpg
Found ! [04/12/2008 20:47] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_1[1].jpg
Found ! [06/12/2008 15:07] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_3[1].jpg
Found ! [07/12/2008 10:24] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_3[2].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\b64_3[3].jpg
Found ! [07/12/2008 16:31] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\mxd[1].jpg
Found ! [07/12/2008 18:59] - C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TV0KZ1VA\mxd[2].jpg
Found ! [16/08/2007 09:50] - C:\Documents and Settings\Invit‚\Local Settings\Temporary Internet Files\Content.IE5\46IUOXJ4\F22A882BB64228F6352C58F4C2852[2].jpg
--------------- [ Registre / Startup ] ----------------
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe
HPDJ Taskbar Utility=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
PrimaLauncher=C:\WINDOWS\system32\Launcher.exe
NVMixerTray="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
NeroCheck=C:\WINDOWS\system32\NeroCheck.exe
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\KeyMaestro=
RepeatFlag=0 (0x0)
PowerEnable=0 (0x0)
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
[HKEY_CURRENT_USER\software\local appwizard-generated applications\flec006]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\qttask]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winfilse]
--------------- [ Registre / Clés infectieuses ] ----------------
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\Local AppWizard-Generated Applications\flec006
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-1078081533-1275210071-839522115-500\Software\FirtR
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\flec006
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S
--------------- [ Etat / Services ] ----------------
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
- sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
- sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
- sans echec non fonctionnel !!
+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - Type de démarrage = 4
/!\ Ip6Fw - Type de démarrage = 4
/!\ SharedAccess - Type de démarrage = 4
/!\ wuauserv - Type de démarrage = 4
/!\ wscsvc - Type de démarrage = 4
--------------- [ Recherche dans supports amovibles] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur de CD-ROM
+- Contenu de l'autorun : D:\autorun.inf
[autorun]
OPEN=autoplay.exe
ICON=setup\media\tpta.ico
TITLEBAR=TreasureArcade
+- presence des fichiers :
Found ! [20/06/2002 19:17][-r-------] - D:\autorun.inf
--------------- [ Registre / Mountpoint2 ] ----------------
-> Not found !
------------------- ! Fin du rapport ! --------------------
Configuration: Windows XP Internet Explorer 6.0
3 réponses
-
c'est une colonie de saloperies que tu héberges!!!
-
Contributeur sécuritésalut,
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
réouvre findykill,
choisi cette fois ci l'option 2 (suppression)
il y aura 2 redémarrages, laisse travailler l'outils jusqu'a l'apparition du message "nettoyage effectué"
un rapport va s'ouvrir, poste le dans ta prochaine réponse stp
Note : le rapport FindyKill.txt est sauvegardé à la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides
-
Contributeur sécuritébon,
tu n'as pas Elibagla sur ton pc?si oui poubelle
ensuite ferme ton pc, réouvre puis tu relances Findykill options 2
si cela ne fonctionne pas on feras autrement
