certainement innfecté

Bonjour, c'est usolidd.

Je suis certainement infecté. J'ai cliqué sur un lien envoyé par msn, et subitement ie8 devient lourd. Je ne peux mm pas installer hijackthis. Et les services de mon Symantec Antivirus sont desactivés et je ne peux les demarrer.

Soit dit en passant, je n'arrive pas a m'authentifier sur le site (kerio.probb).

Merci et a plus!

Bonsoir Usolidd

Citation :

Je ne peux mm pas installer hijackthis.

Tu ne peux pas le lancer ?

Ouvre le Gestionnaire des tâches et fais-en une capture d'écran si tu peux.

Hello Usolidd, Kiyaa, Messieurs


Dis donc tu fais une récolte de virus tous les 6 mois ?
As-tu essayé d'utiliser msnfix pour ton problème ?

Salut les gars,

voici pour le screenshot http://img151.imageshack.us/my.php?image=captureb.jpg

Boule,

je ne connaissais pas cet outils avant aujourd'hui. J'ai choisi "r". au redemarrage du PC, je vois un .txt "catch me" dont voici le contenu

read file error: C:\WINDOWS\system32\avgvrark.exe, The system cannot find the file specified.
read file error: C:\DOCUME~1\Mike-D\LOCALS~1\Temp\winlogon.exe, The system cannot find the file specified.
read file error: C:\DOCUME~1\Mike-D\LOCALS~1\Temp\services.exe, The system cannot find the file specified.
read file error: C:\WINDOWS\system32\cftmon.exe, The system cannot find the file specified.

Et je vois apparaitre sur mn bureau, un dossier "upload me" avc "Winmine" "winlogon" et leurs cousins dedans.

Cet outil permet de supprimer les infections se propageant par MSN, tu peux le faire tourner autour de toi sans problème (il faut malgré tout le retélécharger régulièrement pour avoir la dernière version à jour).

Tu n'as pas un autre rapport dans le dossier de ce programme ? Il ne t'a pas proposé de lancer le nettoyage ? Si oui, l'as-tu fais ? Si non, alors fais-le, car tu es bien infecté par un vers.


Quel est ton anti-virus, je le reconnais pas dans ton gestionnaire des tâches ?

Si tu veux envoyer le dossier Upload Me, il faut le faire via cette URL http://upload.changelog.fr/

Slt Boule...

C'est la galère

Voici ce que j'ai pu trouver ds le dossier MSNfix (que je sais pas utiliser)

read file error: C:\\WINDOWS\\system32\\avgvrark.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\winlogon.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\services.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\cftmon.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\avgvrark.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\winlogon.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\services.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\cftmon.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\avgvrark.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\winlogon.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\services.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\cftmon.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\avgvrark.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\winlogon.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\services.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\cftmon.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\avgvrark.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\winlogon.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\services.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\cftmon.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\avgvrark.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\winlogon.exe, The system cannot find the file specified.
read file error: C:\\DOCUME~1\\Mike-D\\LOCALS~1\\Temp\\services.exe, The system cannot find the file specified.
read file error: C:\\WINDOWS\\system32\\cftmon.exe, The system cannot find the file specified.

Mon AV c'est Symantec Antivirus Corp. Edt. Il est au dodo a cause de cette peste. Impossible de relancer les services symantec. Et quand je tente de lancer le programe, il "n'est pas une application win32 valide"

J'ai essayé bcp de crack c'est jours-ci. Prière te pencher sur cet aspect la aussi.

Merci et a plus...!

Pour savoir si tu as utilisé correctement MSNFIX, regarde ici.


Fais ceci :

Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Déconnecte-toi du net et ferme toutes les programmes en cours.

Double-clic sur Combofix.exe
Au message d'avertissement clic sur "Oui" puis sur F pour l'avoir en français.

Tape 1 quand ça te sera demandé pour lancer le scan et patiente. Si l'ordinateur a besoin de redémarré fais-le tout de suite, le cas échéant poste ici le rapport qui devrait s'afficher à l'écran

Le rapport se trouve ici :
C:\\qoobox\\ComboFix2.txt
C:\\qoobox\\ComboFix3.txt

Cher Boulepate,

Combofix, comme Hijackthis, ne sont pas des applications Win32 valides. Je voulais a tout prix eviter de formater. J'espere que je n'arriverai pas jusque là.

Et en mode sans échec, ça donne quoi ?
Pense à renommer combofix.exe en blablaefef.exe puis réessaye

Profite en en mode sans échec pour supprimer celui-ci : C:\WINDOWS\system32\avgvrark.exe

J'ai trois systemes dans un mm disque :Xp, Vista, 7 RC.

J'arrive a demarrer Win7 et Win Vista en safe mode, mais pour XP, une fois qu'il a fini de defiler les infos, il redemarre.

Alors là !
Tente de faire un scan en ligne avec Bitdefender

Notre ami a l'air plus rusé...Apres s'etre figé a 23, 22, puis 34%, le scan s'est arreté sur un "impossible de scanner l'ordinnateur contre les virus"

As-tu essayé de renommer combofix comme je te l'ai indiqué plus haut ?


Télécharge ceci sur ton bureau
https://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

Installe le programme, dès que c'est fait choisis l'option 1, patiente un rapport va s'ouvrir copie et colle le ici. Si tu ne veux pas attendre, à tes risques, après l'option 1 fais l'option 2.


A voir si ça marche

Salut Boule! Enfin un utilitaire qui fonctionne!

Voici le rapport. je suis pas pressé


############################## [ FindyKill V4.728 ]

# User : Mike-D (Administrators) # HOME-626A311250
# Update on 13/05/09 by Chiquitine29
# Start at: 1:18:37 AM | 5/17/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz
# Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Symantec AntiVirus Corporate Edition 10.1.7.7000 [ (!) Disabled | Updated ]

# A:\ # 3 1/2 Inch Floppy Drive
# C:\ # Local Fixed Disk # 30 Go (16.43 Go free) [Xp] # NTFS
# D:\ # Local Fixed Disk # 49 Go (19.71 Go free) [Vista] # NTFS
# E:\ # Local Fixed Disk # 35.02 Go (24.74 Go free) [7] # NTFS
# F:\ # CD-ROM Disc
# G:\ # Removable Disk # 3.78 Go (3.68 Go free) [MD] # FAT
# M:\ # Local Fixed Disk # 44.53 Go (18.56 Go free) [Music] # NTFS

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Mike-D\Application Data\drivers\winupgro.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Documents and Settings\Mike-D\Application Data\m\flec006.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"C:\Documents and Settings\Mike-D\Application Data\drivers\winupgro.exe" (1800)
"C:\Documents and Settings\Mike-D\Application Data\m\flec006.exe" (1876)
"C:\WINDOWS\system32\wintems.exe" (1884)

################## [ Fichiers / Dossiers infectieux ]

Found ! C:\WINDOWS\Prefetch\15324328.EXE-12462604.pf
Found ! C:\WINDOWS\Prefetch\15505968.EXE-0B9EA243.pf
Found ! C:\WINDOWS\Prefetch\15531578.EXE-214A8D2A.pf
Found ! C:\WINDOWS\Prefetch\155640.EXE-17C5132D.pf
Found ! C:\WINDOWS\Prefetch\157062.EXE-32AB398D.pf
Found ! C:\WINDOWS\Prefetch\15812171.EXE-143D14E7.pf
Found ! C:\WINDOWS\Prefetch\327359.EXE-0D329B35.pf
Found ! C:\WINDOWS\Prefetch\349187.EXE-32678E18.pf
Found ! C:\WINDOWS\Prefetch\352468.EXE-0B67D883.pf
Found ! C:\WINDOWS\Prefetch\401328.EXE-15D65B02.pf
Found ! C:\WINDOWS\Prefetch\740750.EXE-30651172.pf
Found ! C:\WINDOWS\Prefetch\FLEC006.EXE-1D53D499.pf
Found ! C:\WINDOWS\Prefetch\MDELK.EXE-3B00332D.pf
Found ! C:\WINDOWS\Prefetch\WINTEMS.EXE-2B1270B6.pf
Found ! C:\WINDOWS\system32\mdelk.exe
Found ! C:\WINDOWS\system32\wintems.exe
Found ! "C:\Documents and Settings\Mike-D\Application Data\drivers"
Found ! "C:\Documents and Settings\Mike-D\Application Data\drivers\downld"
Found ! "C:\Documents and Settings\Mike-D\Application Data\drivers\srosa2.sys"
Found ! "C:\Documents and Settings\Mike-D\Application Data\drivers\wfsintwq.sys"
Found ! "C:\Documents and Settings\Mike-D\Application Data\drivers\winupgro.exe"
Found ! "C:\Documents and Settings\Mike-D\Application Data\m"
Found ! "C:\Documents and Settings\Mike-D\Application Data\m\data.oct"
Found ! "C:\Documents and Settings\Mike-D\Application Data\m\flec006.exe"
Found ! "C:\Documents and Settings\Mike-D\Application Data\m\list.oct"
Found ! "C:\Documents and Settings\Mike-D\Application Data\m\shared"
Found ! "C:\Documents and Settings\Mike-D\Application Data\m\srvlist.oct"

################## [ Infected Temp Files ]

Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\CX6FQZHW\b64_1[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\E9W3OB36\b64[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\E9W3OB36\mxd[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\FQDRDRDI\b64_1[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KBV76O11\b64_3[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KBV76O11\file[1].txt
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KP0LUJK9\b64_3[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KP0LUJK9\mxd[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KP0LUJK9\mxd[2].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\M2HYEE9H\b64_3[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\TAG9JIWS\b64_1[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\V2R8HCVY\b64[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\V2R8HCVY\b64_1[1].jpg
Found ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\XXJG73H6\b64_3[1].jpg

################## [ Registre / Clés infectieuses ]

Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\Local AppWizard-Generated Applications\install_patch
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\bisoft
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\DateTime4
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\FFC
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\MuleAppData
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_CURRENT_USER\Software\bisoft
Found ! HKEY_CURRENT_USER\Software\DateTime4
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# (!) HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# (!) HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]


################## [ Registre / Mountpoints2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.728 ! ]

C'est ok, on remarque bien l'infection via les cracks ... comme je te l'avais dit l'autrefois, un jour ça pardonnera pas

Lance l'option 2 pour exécuter le nettoyage

Hey! Voici le rapport.
je crois que je v devoir reinstallert Symantec AV!

Thanks!

euhh..le rapport est la

############################## [ FindyKill V4.728 ]

# User : Mike-D (Administrators) # HOME-626A311250
# Update on 13/05/09 by Chiquitine29
# Start at: 11:22:35 AM | 5/17/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz
# Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Symantec AntiVirus Corporate Edition 10.1.7.7000 [ (!) Disabled | Updated ]

# A:\ # 3 1/2 Inch Floppy Drive
# C:\ # Local Fixed Disk # 30 Go (16.38 Go free) [Xp] # NTFS
# D:\ # Local Fixed Disk # 49 Go (19.68 Go free) [Vista] # NTFS
# E:\ # Local Fixed Disk # 35.02 Go (24.74 Go free) [7] # NTFS
# F:\ # CD-ROM Disc
# M:\ # Local Fixed Disk # 44.53 Go (18.56 Go free) [Music] # NTFS

############################## [ Active Processes ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Infected Files \ Folders ]

Deleted ! C:\WINDOWS\Prefetch\15324328.EXE-12462604.pf
Deleted ! C:\WINDOWS\Prefetch\15505968.EXE-0B9EA243.pf
Deleted ! C:\WINDOWS\Prefetch\15531578.EXE-214A8D2A.pf
Deleted ! C:\WINDOWS\Prefetch\155640.EXE-17C5132D.pf
Deleted ! C:\WINDOWS\Prefetch\157062.EXE-32AB398D.pf
Deleted ! C:\WINDOWS\Prefetch\15812171.EXE-143D14E7.pf
Deleted ! C:\WINDOWS\Prefetch\313828.EXE-17AB0240.pf
Deleted ! C:\WINDOWS\Prefetch\327359.EXE-0D329B35.pf
Deleted ! C:\WINDOWS\Prefetch\349187.EXE-32678E18.pf
Deleted ! C:\WINDOWS\Prefetch\352468.EXE-0B67D883.pf
Deleted ! C:\WINDOWS\Prefetch\390968.EXE-361F1DC7.pf
Deleted ! C:\WINDOWS\Prefetch\401328.EXE-15D65B02.pf
Deleted ! C:\WINDOWS\Prefetch\418531.EXE-365CE2FC.pf
Deleted ! C:\WINDOWS\Prefetch\487265.EXE-08B955B2.pf
Deleted ! C:\WINDOWS\Prefetch\540031.EXE-216C6ED5.pf
Deleted ! C:\WINDOWS\Prefetch\719906.EXE-0713ACDA.pf
Deleted ! C:\WINDOWS\Prefetch\740750.EXE-30651172.pf
Deleted ! C:\WINDOWS\Prefetch\838156.EXE-12F11F87.pf
Deleted ! C:\WINDOWS\Prefetch\FLEC006.EXE-1D53D499.pf
Deleted ! C:\WINDOWS\Prefetch\MDELK.EXE-3B00332D.pf
Deleted ! C:\WINDOWS\Prefetch\WINTEMS.EXE-2B1270B6.pf
Deleted ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-16ABE98D.pf
Deleted ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-1A1A4116.pf
Deleted ! C:\WINDOWS\system32\mdelk.exe
Deleted ! C:\WINDOWS\system32\wintems.exe
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\drivers\srosa2.sys"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\drivers\wfsintwq.sys"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\drivers\winupgro.exe"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\m\data.oct"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\m\flec006.exe"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\m\list.oct"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\m\srvlist.oct"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\drivers\downld"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\drivers"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\m\shared"
Deleted ! "C:\Documents and Settings\Mike-D\Application Data\m"

################## [ Infected Temp Files ]

Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\2H4JMP65\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\CX6FQZHW\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\D3ZOZ9F3\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\D3ZOZ9F3\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\E9W3OB36\b64[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\E9W3OB36\mxd[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\FQDRDRDI\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KBV76O11\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KP0LUJK9\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KP0LUJK9\mxd[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\KP0LUJK9\mxd[2].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\M2HYEE9H\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\MFU94O7E\b64[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\MFU94O7E\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\TAG9JIWS\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\U7IJ6PYB\file[1].txt
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\V2R8HCVY\b64[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\V2R8HCVY\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\XXJG73H6\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Mike-D\Local Settings\Temporary Internet Files\Content.IE5\YCOO5C95\b64_1[1].jpg

################## [ Registry / Infected keys ]

Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Deleted ! HKEY_CURRENT_USER\Software\bisoft
Deleted ! HKEY_CURRENT_USER\Software\DateTime4
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\FFC
Deleted ! HKEY_USERS\S-1-5-21-1659004503-73586283-725345543-1003\Software\MuleAppData
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

################## [ Cleaning Removable drives ]


################## [ Registry / Mountpoint2 ]

# -> Not found !

################## [ States / Restarting of services ]

# Services : [ Auto=2 / Request=3 / Disable=4 ]

# Ndisuio -> # Type of startup =3
# Ip6Fw -> # Type of startup =2
# SharedAccess -> # Type of startup =2
# wuauserv -> # Type of startup =2
# wscsvc -> # Type of startup =2
# Safe boot mode restored !

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

File ... : C:\Documents and Settings\Mike-D\Application Data\drivers\winupgro.exe
CRC32 .. : a1f7a07d
MD5 .... : 1fc635eea11997dfaa632a6055d7ae9e

Deleted ! : C:\Program Files\eMule\Incoming\642-432 Practice Exam Testing Engine Software 1.0 [With Crack].zip
Contain install_patch.exe [864256] with Bagle CRC32 : A1F7A07D

Deleted ! : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
# Taille : 864256 # MD5 : 1FC635EEA11997DFAA632A6055D7AE9E


################## [ Corrupted files # Re-Installation required ]

C:\Documents and Settings\All Users\Desktop\ComboFix.exe
C:\Program Files\account\bank accoun\HijackThis.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
C:\Program Files\Symantec\LiveUpdate\LUALL.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE
C:\Program Files\Symantec\LiveUpdate\LuConfig.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\VPC32.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

################################### [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! End of Report # FindyKill V4.728 ! ]

et voici pour Hijackthis (en cas de besoin...)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:40 AM, on 5/17/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Account\Account\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.mini20.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://apaccess1.spt.unisys.com/dana-cached/setup/JuniperSetupSP1.cab
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 6572 bytes

C'est ok
Pour Symantec, je te conseille et si tu le peux de le virer, il est nul ! Je te conseille d'installer AntiVir bien plus efficace toi qui télécharge souvent des choses infectés


Pense à installer la dernière version d'Adobe Reader (source d'infections quand pas à jour)
http://www.adobe.com/fr/products/reader/


Garde au cas où FindyKill sur ton bureau

Merci Boule! Je vien d'installer Symantec Endpoint P. et il a raser des infections.
J'ai besoin de Symantec pour me connecter au VPN de mon entreprise :(

Ya moyen d'installer les deux Antivirus sans qu'ils se marchent sur les pieds?

Je m'occupe d'Adobe.

Merci!

Non, ne mieux vaut pas installer les deux il risque d'y avoir un conflit qui pourrait ne pas pardonner Garde l'adresse du scan de Bitdefender en ligne et utilise le de temps en temps (pas quand il est trop tard) afin de vérifier que tout est clean.

Merci pour tout Boulepate. A plus!