[HELP] Virus Bagle ? Bloque anti-virus...
Résolu/Fermé
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
-
18 janv. 2009 à 18:01
moe - 18 janv. 2009 à 23:05
moe - 18 janv. 2009 à 23:05
A voir également:
- [HELP] Virus Bagle ? Bloque anti-virus...
- Uptobox bloqué - Guide
- Code puk bloqué - Guide
- Vérificateur de lien virus - Guide
- Comment savoir si on est bloqué sur messenger - Guide
- Pavé tactile bloqué - Guide
15 réponses
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
18 janv. 2009 à 18:05
18 janv. 2009 à 18:05
Bonjour
Télécharge FindyKill de Chiquitine29 :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
->Enregistre-le sur ton bureau et pas ailleurs !
!! Déconnecte toi et ferme toutes les applications en cours !!
( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)
-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.
Tuto : https://www.malekal.com/tutorial-findykill/
--> Double-clique sur le raccourci " FindyKill " qui est sur ton bureau .
-->choisis l'option 1 ( recherche ) . Puis laisse travailler l'outil sans rien toucher ...
Une fois terminé, poste le rapport FindyKill.txt qui est généré ...
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.--
Télécharge FindyKill de Chiquitine29 :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
->Enregistre-le sur ton bureau et pas ailleurs !
!! Déconnecte toi et ferme toutes les applications en cours !!
( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)
-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.
Tuto : https://www.malekal.com/tutorial-findykill/
--> Double-clique sur le raccourci " FindyKill " qui est sur ton bureau .
-->choisis l'option 1 ( recherche ) . Puis laisse travailler l'outil sans rien toucher ...
Une fois terminé, poste le rapport FindyKill.txt qui est généré ...
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.--
plopus
Messages postés
5962
Date d'inscription
jeudi 1 janvier 2009
Statut
Contributeur sécurité
Dernière intervention
11 mars 2012
293
18 janv. 2009 à 18:06
18 janv. 2009 à 18:06
Bonjour,
desactive tes defense, il est detecté a tord et
telecharge findykill
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
installe le execute le et choisit ta langue puis option 1 et poste le rapport stp
desactive tes defense, il est detecté a tord et
telecharge findykill
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe
installe le execute le et choisit ta langue puis option 1 et poste le rapport stp
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 18:13
18 janv. 2009 à 18:13
Rebonsoir, merci de vos réponses !!
Voici un copier coller du rapport :
----------------- FindyKill V4.713 ------------------
* User : Muriel - SARDOU-89F368F0
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/01/09 par Chiquitine29
* Recherche effectuée à 18:11:06 le 18/01/2009
* Windows XP - Internet Explorer 7.0.5730.13
((((((((((((((((( *** Recherche *** ))))))))))))))))))
--------------- [ Processus actifs ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\vVX3000.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
--------------- [ Fichiers/Dossiers infectieux ] ----------------
»»»» Presence des fichiers dans C:
Found ! [18/01/2009 16:54] - "C:\Muestras"
Found ! [18/01/2009 17:19] - C:\InfoSat.txt
»»»» Presence des fichiers dans C:\WINDOWS
»»»» Presence des fichiers dans C:\WINDOWS\Prefetch
Found ! - C:\WINDOWS\prefetch\116625.EXE-252DFD4D.pf
Found ! - C:\WINDOWS\prefetch\173656.EXE-33BABBCE.pf
Found ! - C:\WINDOWS\prefetch\184921.EXE-17BB6BF7.pf
Found ! - C:\WINDOWS\prefetch\210187.EXE-16EAD217.pf
Found ! - C:\WINDOWS\prefetch\233718.EXE-1BCFDFA3.pf
Found ! - C:\WINDOWS\prefetch\243468.EXE-30805E02.pf
Found ! - C:\WINDOWS\prefetch\244578.EXE-0DF161C4.pf
Found ! - C:\WINDOWS\prefetch\53015.EXE-2418781D.pf
Found ! - C:\WINDOWS\prefetch\82453.EXE-217BC6DC.pf
Found ! - C:\WINDOWS\prefetch\85062.EXE-0CB16E66.pf
Found ! - C:\WINDOWS\prefetch\96734.EXE-07407A0B.pf
Found ! - C:\WINDOWS\prefetch\99484.EXE-0AAD6F18.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-3091FB48.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-3B00332D.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2B1270B6.pf
»»»» Presence des fichiers dans C:\WINDOWS\system32
Found ! [18/01/2009 16:52] - C:\WINDOWS\system32\mdelk.exe
Found ! [18/01/2009 16:52] - C:\WINDOWS\system32\wintems.exe
Found ! [18/01/2009 17:53] - C:\WINDOWS\system32\ban_list.txt
»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers
»»»» Presence des fichiers dans C:\Documents and Settings\Muriel\Application Data
Found ! [18/01/2009 16:49] - "C:\Documents and Settings\Muriel\Application Data\m\flec006.exe"
Found ! [18/01/2009 16:50] - "C:\Documents and Settings\Muriel\Application Data\m\shared"
Found ! [18/01/2009 16:54] - "C:\Documents and Settings\Muriel\Application Data\m"
Found ! [18/01/2009 16:54] - "C:\Documents and Settings\Muriel\Application Data\drivers"
Found ! [18/01/2009 16:49] - "C:\Documents and Settings\Muriel\Application Data\drivers\wfsintwq.sys"
Found ! [04/02/2004 02:06] - "C:\Documents and Settings\Muriel\Application Data\drivers\winupgro.exe"
Found ! [18/01/2009 16:54] - "C:\Documents and Settings\Muriel\Application Data\drivers\downld"
»»»» Presence des fichiers dans C:\DOCUME~1\Muriel\LOCALS~1\Temp
--------------- [ Registre / Startup ] ----------------
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
HDAudDeck=C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz=nwiz.exe /install
WinSys2=C:\WINDOWS\system32\winsys2.exe
NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
CanonSolutionMenu=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
CanonMyPrinter=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
SSBkgdUpdate="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
OpwareSE4="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe"
VX3000=C:\WINDOWS\vVX3000.exe
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
PCSuiteTrayApplication=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_CURRENT_USER\software\local appwizard-generated applications\MsnMsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\setup]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]
--------------- [ Registre / Clés infectieuses ] ----------------
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\FirtR
/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1
--------------- [ Etat / Services ] ----------------
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
/!\ Mode sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
/!\ Mode sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
/!\ Mode sans echec non fonctionnel !!
+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - Type de démarrage = 4
EapHost - Type de démarrage = 3
/!\ Ip6Fw - Type de démarrage = 4
SharedAccess - Type de démarrage = 2
wuauserv - Type de démarrage = 2
/!\ wscsvc - Type de démarrage = 4
--------------- [ Recherche dans supports amovibles] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur fixe
F: - Lecteur fixe
+- presence des fichiers :
--------------- [ Registre / Mountpoint2 ] ----------------
-> Not found !
------------------- ! Fin du rapport ! --------------------
Voici un copier coller du rapport :
----------------- FindyKill V4.713 ------------------
* User : Muriel - SARDOU-89F368F0
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/01/09 par Chiquitine29
* Recherche effectuée à 18:11:06 le 18/01/2009
* Windows XP - Internet Explorer 7.0.5730.13
((((((((((((((((( *** Recherche *** ))))))))))))))))))
--------------- [ Processus actifs ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\vVX3000.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
--------------- [ Fichiers/Dossiers infectieux ] ----------------
»»»» Presence des fichiers dans C:
Found ! [18/01/2009 16:54] - "C:\Muestras"
Found ! [18/01/2009 17:19] - C:\InfoSat.txt
»»»» Presence des fichiers dans C:\WINDOWS
»»»» Presence des fichiers dans C:\WINDOWS\Prefetch
Found ! - C:\WINDOWS\prefetch\116625.EXE-252DFD4D.pf
Found ! - C:\WINDOWS\prefetch\173656.EXE-33BABBCE.pf
Found ! - C:\WINDOWS\prefetch\184921.EXE-17BB6BF7.pf
Found ! - C:\WINDOWS\prefetch\210187.EXE-16EAD217.pf
Found ! - C:\WINDOWS\prefetch\233718.EXE-1BCFDFA3.pf
Found ! - C:\WINDOWS\prefetch\243468.EXE-30805E02.pf
Found ! - C:\WINDOWS\prefetch\244578.EXE-0DF161C4.pf
Found ! - C:\WINDOWS\prefetch\53015.EXE-2418781D.pf
Found ! - C:\WINDOWS\prefetch\82453.EXE-217BC6DC.pf
Found ! - C:\WINDOWS\prefetch\85062.EXE-0CB16E66.pf
Found ! - C:\WINDOWS\prefetch\96734.EXE-07407A0B.pf
Found ! - C:\WINDOWS\prefetch\99484.EXE-0AAD6F18.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-3091FB48.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-3B00332D.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2B1270B6.pf
»»»» Presence des fichiers dans C:\WINDOWS\system32
Found ! [18/01/2009 16:52] - C:\WINDOWS\system32\mdelk.exe
Found ! [18/01/2009 16:52] - C:\WINDOWS\system32\wintems.exe
Found ! [18/01/2009 17:53] - C:\WINDOWS\system32\ban_list.txt
»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers
»»»» Presence des fichiers dans C:\Documents and Settings\Muriel\Application Data
Found ! [18/01/2009 16:49] - "C:\Documents and Settings\Muriel\Application Data\m\flec006.exe"
Found ! [18/01/2009 16:50] - "C:\Documents and Settings\Muriel\Application Data\m\shared"
Found ! [18/01/2009 16:54] - "C:\Documents and Settings\Muriel\Application Data\m"
Found ! [18/01/2009 16:54] - "C:\Documents and Settings\Muriel\Application Data\drivers"
Found ! [18/01/2009 16:49] - "C:\Documents and Settings\Muriel\Application Data\drivers\wfsintwq.sys"
Found ! [04/02/2004 02:06] - "C:\Documents and Settings\Muriel\Application Data\drivers\winupgro.exe"
Found ! [18/01/2009 16:54] - "C:\Documents and Settings\Muriel\Application Data\drivers\downld"
»»»» Presence des fichiers dans C:\DOCUME~1\Muriel\LOCALS~1\Temp
--------------- [ Registre / Startup ] ----------------
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
HDAudDeck=C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz=nwiz.exe /install
WinSys2=C:\WINDOWS\system32\winsys2.exe
NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
CanonSolutionMenu=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
CanonMyPrinter=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
SSBkgdUpdate="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
OpwareSE4="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe"
VX3000=C:\WINDOWS\vVX3000.exe
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
PCSuiteTrayApplication=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_CURRENT_USER\software\local appwizard-generated applications\MsnMsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\setup]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]
--------------- [ Registre / Clés infectieuses ] ----------------
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\FirtR
/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1
--------------- [ Etat / Services ] ----------------
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
/!\ Mode sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
/!\ Mode sans echec non fonctionnel !!
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
/!\ Mode sans echec non fonctionnel !!
+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - Type de démarrage = 4
EapHost - Type de démarrage = 3
/!\ Ip6Fw - Type de démarrage = 4
SharedAccess - Type de démarrage = 2
wuauserv - Type de démarrage = 2
/!\ wscsvc - Type de démarrage = 4
--------------- [ Recherche dans supports amovibles] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur fixe
F: - Lecteur fixe
+- presence des fichiers :
--------------- [ Registre / Mountpoint2 ] ----------------
-> Not found !
------------------- ! Fin du rapport ! --------------------
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
18 janv. 2009 à 18:14
18 janv. 2009 à 18:14
Important :
Branche toutes tes unités externes au PC ( DD externes , clé USB , lecteur mp3, ect...) mais sans les ouvrir !
Tu les retireras après la manipe ...
Ferme toutes les applications en cours !
Relance FindyKill :
-> choisis cette fois-ci l'option 2 (suppression).
/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message :
"nettoyage terminé" .
Note : lors du message d'avertissement , cliques sur " Ok " .
--> Poste le nouveau rapport FindyKill.txt qui est généré.
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tapes explorer.exe et valide .
Branche toutes tes unités externes au PC ( DD externes , clé USB , lecteur mp3, ect...) mais sans les ouvrir !
Tu les retireras après la manipe ...
Ferme toutes les applications en cours !
Relance FindyKill :
-> choisis cette fois-ci l'option 2 (suppression).
/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message :
"nettoyage terminé" .
Note : lors du message d'avertissement , cliques sur " Ok " .
--> Poste le nouveau rapport FindyKill.txt qui est généré.
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
PS : Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tapes explorer.exe et valide .
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 18:25
18 janv. 2009 à 18:25
Merci encore, j'ai effectué cette opération (2re démarrages auto) voici le rapport :
----------------- FindyKill V4.713 ------------------
* User : Muriel - SARDOU-89F368F0
* Executed from : C:\Program Files\FindyKill
* Update on 17/01/09 by Chiquitine29
* Start at 18:21:48 the 18/01/2009
* Windows XP - Internet Explorer 7.0.5730.13
((((((((((((((( *** deleting *** ))))))))))))))))))
--------------- [ Active Processes ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\userinit.exe
--------------- [ Infected files / folders ] ----------------
»»»» Supression files in C:
Deleted ! - "C:\Muestras"
Deleted ! - C:\InfoSat.txt
»»»» Supression files in C:\WINDOWS
»»»» Supression files in C:\WINDOWS\Prefetch
Deleted ! - C:\WINDOWS\prefetch\116625.EXE-252DFD4D.pf
Deleted ! - C:\WINDOWS\prefetch\173656.EXE-33BABBCE.pf
Deleted ! - C:\WINDOWS\prefetch\184921.EXE-17BB6BF7.pf
Deleted ! - C:\WINDOWS\prefetch\210187.EXE-16EAD217.pf
Deleted ! - C:\WINDOWS\prefetch\233718.EXE-1BCFDFA3.pf
Deleted ! - C:\WINDOWS\prefetch\243468.EXE-30805E02.pf
Deleted ! - C:\WINDOWS\prefetch\244578.EXE-0DF161C4.pf
Deleted ! - C:\WINDOWS\prefetch\53015.EXE-2418781D.pf
Deleted ! - C:\WINDOWS\prefetch\82453.EXE-217BC6DC.pf
Deleted ! - C:\WINDOWS\prefetch\85062.EXE-0CB16E66.pf
Deleted ! - C:\WINDOWS\prefetch\96734.EXE-07407A0B.pf
Deleted ! - C:\WINDOWS\prefetch\99484.EXE-0AAD6F18.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-3091FB48.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-3B00332D.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2B1270B6.pf
»»»» Supression files in C:\WINDOWS\system32
Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt
»»»» Supression files in C:\WINDOWS\system32\drivers
»»»» Supression files in C:\Documents and Settings\Muriel\Application Data
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\m\flec006.exe"
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\190-712 - IBM Lotus Notes Domino 7 Developing Web Applications Practice Exam Questions 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\312-49 Practice Exam Testing Engine Software 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\3DM Import for AutoCAD 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\3GP to FLV Converter 1.01.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\7isv DVD Video Converter 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Abdio Hex Editor 5.9 Build 80124.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Abee MP3 Database Organizer 1.0.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Abilities Builder Add & Subtract Fractions 3.5.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Able2Extract 6.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ActivoMeter 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Actualizacion.Panda.Antivirus.pav.sig.05-10-2006.by.pulga.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AI Robot 4.1 Build 280.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Alternate Timer 2.903.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Antrasoft SpamKiller 2.95.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ASI FrontDesk 5.3.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AsterWin 1.20.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Automatically Unzip Files Software 7.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AutoShuttter 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AVG.antivirus.7.1.ita.+KEYGENERATOR.+.personal.firewall.plus.(TESTATO).ReDiRETE.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Beautiful Britain winter screensaver 1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\BillsNet 2.98.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\BroadCam 1.01.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Browzar 1.5.0.0 Beta.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Business Service Management Business Edition 2.1.5.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\CIB PDF Brewer 2.5.20.5.3.218.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Coloring Book 6
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\CopyAudioCD 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ctCalendar 4.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\DB2 Code Factory 8.7.0.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\DBstru 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Desktop BBC News 0.95.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Dilbert Daily 1.0.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Disk2File 1.31.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\EA Mobile Asterix 2008 240x320.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\EldoS TimelyWeb 4.2.0.215.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\EMX Movie Converter 2007 3.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Energy Conversion Spreadsheet 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ES-Insight 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\eSan MP3 Builder 2.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Everyday Auto Backup 1.10.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\FastStone Capture 6.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Folder Ward XP 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Foldey 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\FollowUpXpert Standard 4.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Ford Escort Screensaver 1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Ford Mustang Screensaver2 1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Form Designer VB 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Fractal Mandelbrot 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\GDSIIExporter 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Giza Pyramids 3D Screensaver 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\GlueCut 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Google Desktop Search plugin beta.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Google Logo Gadget 1.0.0.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\HandyThumb 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Hbedv.H.Bedv.Antivir.Pe.Personal.Edition.Premium.Key.(Workstation).6.30.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\HTML-Code-Cut 80.70a.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\InstallBuddy 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\IP Country Lookup 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\IrfanView 4.20.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ISDNCid 2.3.0.10.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Juicy Studio Accessibility Toolbar 1.35.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Kaspersky.Antivirus.Personal.Pro.5.0.149.4.Fr.&.Key.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Keystroke POS 6.10 build 30.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Life Tools 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\LingvoSoft Dictionary 2007 German - Turkish 4.0.22.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Magic
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\MagicTable 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Maine Winter Scenes ScreenSaver 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\mcafee virusscan.9.2005.firewall.9.2005.spamkiller.2005.privacy service.eng.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\McAfee.E-Business.Server.v8.1.Retail.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\McAfee.Host.Intrusion.Prevention.v6.0.Server.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\MDB Exporter 1.0.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Mean Snoring Mouse 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Merriam-Webster English Dictionary 6.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\MESHMER 2.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Microsoft XNA Game Studio 3.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Midicode Oscilloscope Analyser 1.01.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\My-T-Soft Build-A-Board Builder 2.10.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Network Mechanic 3.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\NetworkActiv Port Scanner 4.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\NewBlue Art Blends 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Open Subfolder 1.0.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\PCsync 5.05.2900.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Plato DVD to Divx Xvid Ripper 7.90.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Popup Prank 1.00.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Portable i.Scribe 1.90.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\PowerPoint Templates 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Quotes 2006.2.1.4.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Raw Data Printer Component 2.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Recycle bin Vista Gadget 1.0.1.7.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Reveal 2 Radio 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\RSS Content Generator Professional 3.1.58.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Screen Mate Builder 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\SH Medusa 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Shellbook 1.1.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Slam 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\SoftPepper DVD to AVI Converter 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Sony [176x208] LEGO Bricks Mobile [W550i].zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Subtitles Creator 2.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Symantec Mail Security License 1165464.7 Slf(2).zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Symantec.Mobile.Security.4.0.For.Symbian.[Multilanguage]-.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Tao.Tao-Les.histoires.de.Pandi-Panda(Vol8.da.fr-Ǹpisode.1.Çÿ.4).dvd.rip.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Team USA 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Television Online 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\TestLAB 3.0.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Text Codec 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Text Template Parser 1.4.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\The Hubble Space Telescope Part 1 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\TIFF Assembler 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\TorChat 0.9.9.277.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Turkey Flag 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Understand for JOVIAL 1.4 Build 375.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\USC Image File Name Management System 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Vectrik 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Virus Database Update for Protector Plus 8.0.E08.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\WaveDX7 2.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Ways to Make Money with a Digital Camera 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Whisper32 1.16.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\winspy 2.01220.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Winter 3D ScreenSaver 1.00.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Wizz RSS News Reader 3.0.0.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\WMSmart 2.1.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Wondershare PPT2Video Converter 1.1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Xena toolbar for IE 4.5.129.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Yahoo! Answers 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Yet Another Photo Screen Saver 1.5.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Zanebug 1.6.0.zip
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\m"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers\wfsintwq.sys"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers\winupgro.exe"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers"
»»»» Supression files in C:\DOCUME~1\Muriel\LOCALS~1\Temp
»»»» Supression files in C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FCQTBK8V\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FCQTBK8V\file[1].txt
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\b64[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\mxd[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\servernames[1].htm
--------------- [ Registry / Infected keys ] ----------------
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\MsnMsgr
Deleted ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\MuleAppData
--------------- [ States / Restarting of services ] ----------------
+- Safe boot mode restored !
+- Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - Type of startup = 3
EapHost - Type of startup = 2
Ip6Fw - Type of startup = 2
SharedAccess - Type of startup = 2
wuauserv - Type of startup = 2
wscsvc - Type of startup = 2
--------------- [ Cleaning removable drives ] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur fixe
F: - Lecteur fixe
G: - Lecteur amovible
H: - Lecteur amovible
+- deleting files :
Not deleted !! - G:\autorun.inf
Deleted ! - H:\autorun.inf
--------------- [ Registry / Mountpoint2 ] ----------------
-> Not found !
--------------- [ Searching Other Infections ] ----------------
Références de comparaison Bagle MD5 :
113ac36b77630a2f67dd6cb7844406a4 C:\WINDOWS\system32\mdelk.exe
113ac36b77630a2f67dd6cb7844406a4 C:\WINDOWS\system32\wintems.exe
895c7dd60d43bc828d2355a956d9db27 C:\Documents and Settings\Muriel\Application Data\drivers\winupgro.exe
895c7dd60d43bc828d2355a956d9db27 C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
Suspect ! - 895c7dd60d43bc828d2355a956d9db27 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
--------------- [ Searching Cracks / Keygen ] ----------------
---------------- ! End of report ! ------------------
----------------- FindyKill V4.713 ------------------
* User : Muriel - SARDOU-89F368F0
* Executed from : C:\Program Files\FindyKill
* Update on 17/01/09 by Chiquitine29
* Start at 18:21:48 the 18/01/2009
* Windows XP - Internet Explorer 7.0.5730.13
((((((((((((((( *** deleting *** ))))))))))))))))))
--------------- [ Active Processes ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\userinit.exe
--------------- [ Infected files / folders ] ----------------
»»»» Supression files in C:
Deleted ! - "C:\Muestras"
Deleted ! - C:\InfoSat.txt
»»»» Supression files in C:\WINDOWS
»»»» Supression files in C:\WINDOWS\Prefetch
Deleted ! - C:\WINDOWS\prefetch\116625.EXE-252DFD4D.pf
Deleted ! - C:\WINDOWS\prefetch\173656.EXE-33BABBCE.pf
Deleted ! - C:\WINDOWS\prefetch\184921.EXE-17BB6BF7.pf
Deleted ! - C:\WINDOWS\prefetch\210187.EXE-16EAD217.pf
Deleted ! - C:\WINDOWS\prefetch\233718.EXE-1BCFDFA3.pf
Deleted ! - C:\WINDOWS\prefetch\243468.EXE-30805E02.pf
Deleted ! - C:\WINDOWS\prefetch\244578.EXE-0DF161C4.pf
Deleted ! - C:\WINDOWS\prefetch\53015.EXE-2418781D.pf
Deleted ! - C:\WINDOWS\prefetch\82453.EXE-217BC6DC.pf
Deleted ! - C:\WINDOWS\prefetch\85062.EXE-0CB16E66.pf
Deleted ! - C:\WINDOWS\prefetch\96734.EXE-07407A0B.pf
Deleted ! - C:\WINDOWS\prefetch\99484.EXE-0AAD6F18.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-3091FB48.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-3B00332D.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2B1270B6.pf
»»»» Supression files in C:\WINDOWS\system32
Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt
»»»» Supression files in C:\WINDOWS\system32\drivers
»»»» Supression files in C:\Documents and Settings\Muriel\Application Data
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\m\flec006.exe"
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\190-712 - IBM Lotus Notes Domino 7 Developing Web Applications Practice Exam Questions 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\312-49 Practice Exam Testing Engine Software 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\3DM Import for AutoCAD 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\3GP to FLV Converter 1.01.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\7isv DVD Video Converter 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Abdio Hex Editor 5.9 Build 80124.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Abee MP3 Database Organizer 1.0.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Abilities Builder Add & Subtract Fractions 3.5.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Able2Extract 6.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ActivoMeter 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Actualizacion.Panda.Antivirus.pav.sig.05-10-2006.by.pulga.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AI Robot 4.1 Build 280.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Alternate Timer 2.903.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Antrasoft SpamKiller 2.95.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ASI FrontDesk 5.3.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AsterWin 1.20.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Automatically Unzip Files Software 7.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AutoShuttter 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\AVG.antivirus.7.1.ita.+KEYGENERATOR.+.personal.firewall.plus.(TESTATO).ReDiRETE.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Beautiful Britain winter screensaver 1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\BillsNet 2.98.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\BroadCam 1.01.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Browzar 1.5.0.0 Beta.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Business Service Management Business Edition 2.1.5.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\CIB PDF Brewer 2.5.20.5.3.218.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Coloring Book 6
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\CopyAudioCD 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ctCalendar 4.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\DB2 Code Factory 8.7.0.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\DBstru 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Desktop BBC News 0.95.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Dilbert Daily 1.0.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Disk2File 1.31.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\EA Mobile Asterix 2008 240x320.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\EldoS TimelyWeb 4.2.0.215.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\EMX Movie Converter 2007 3.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Energy Conversion Spreadsheet 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ES-Insight 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\eSan MP3 Builder 2.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Everyday Auto Backup 1.10.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\FastStone Capture 6.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Folder Ward XP 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Foldey 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\FollowUpXpert Standard 4.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Ford Escort Screensaver 1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Ford Mustang Screensaver2 1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Form Designer VB 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Fractal Mandelbrot 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\GDSIIExporter 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Giza Pyramids 3D Screensaver 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\GlueCut 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Google Desktop Search plugin beta.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Google Logo Gadget 1.0.0.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\HandyThumb 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Hbedv.H.Bedv.Antivir.Pe.Personal.Edition.Premium.Key.(Workstation).6.30.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\HTML-Code-Cut 80.70a.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\InstallBuddy 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\IP Country Lookup 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\IrfanView 4.20.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\ISDNCid 2.3.0.10.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Juicy Studio Accessibility Toolbar 1.35.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Kaspersky.Antivirus.Personal.Pro.5.0.149.4.Fr.&.Key.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Keystroke POS 6.10 build 30.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Life Tools 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\LingvoSoft Dictionary 2007 German - Turkish 4.0.22.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Magic
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\MagicTable 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Maine Winter Scenes ScreenSaver 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\mcafee virusscan.9.2005.firewall.9.2005.spamkiller.2005.privacy service.eng.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\McAfee.E-Business.Server.v8.1.Retail.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\McAfee.Host.Intrusion.Prevention.v6.0.Server.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\MDB Exporter 1.0.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Mean Snoring Mouse 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Merriam-Webster English Dictionary 6.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\MESHMER 2.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Microsoft XNA Game Studio 3.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Midicode Oscilloscope Analyser 1.01.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\My-T-Soft Build-A-Board Builder 2.10.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Network Mechanic 3.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\NetworkActiv Port Scanner 4.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\NewBlue Art Blends 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Open Subfolder 1.0.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\PCsync 5.05.2900.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Plato DVD to Divx Xvid Ripper 7.90.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Popup Prank 1.00.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Portable i.Scribe 1.90.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\PowerPoint Templates 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Quotes 2006.2.1.4.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Raw Data Printer Component 2.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Recycle bin Vista Gadget 1.0.1.7.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Reveal 2 Radio 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\RSS Content Generator Professional 3.1.58.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Screen Mate Builder 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\SH Medusa 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Shellbook 1.1.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Slam 1.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\SoftPepper DVD to AVI Converter 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Sony [176x208] LEGO Bricks Mobile [W550i].zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Subtitles Creator 2.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Symantec Mail Security License 1165464.7 Slf(2).zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Symantec.Mobile.Security.4.0.For.Symbian.[Multilanguage]-.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Tao.Tao-Les.histoires.de.Pandi-Panda(Vol8.da.fr-Ǹpisode.1.Çÿ.4).dvd.rip.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Team USA 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Television Online 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\TestLAB 3.0.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Text Codec 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Text Template Parser 1.4.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\The Hubble Space Telescope Part 1 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\TIFF Assembler 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\TorChat 0.9.9.277.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Turkey Flag 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Understand for JOVIAL 1.4 Build 375.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\USC Image File Name Management System 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Vectrik 1.1.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Virus Database Update for Protector Plus 8.0.E08.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\WaveDX7 2.2.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Ways to Make Money with a Digital Camera 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Whisper32 1.16.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\winspy 2.01220.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Winter 3D ScreenSaver 1.00.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Wizz RSS News Reader 3.0.0.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\WMSmart 2.1.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Wondershare PPT2Video Converter 1.1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Xena toolbar for IE 4.5.129.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Yahoo! Answers 1.0.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Yet Another Photo Screen Saver 1.5.3.zip
Deleted ! - C:\Documents and Settings\Muriel\Application Data\m\shared\Zanebug 1.6.0.zip
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\m"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers\wfsintwq.sys"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers\winupgro.exe"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\Muriel\Application Data\drivers"
»»»» Supression files in C:\DOCUME~1\Muriel\LOCALS~1\Temp
»»»» Supression files in C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FCQTBK8V\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FCQTBK8V\file[1].txt
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\FTYCVCWM\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\HVXSOJEO\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\b64[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\mxd[1].jpg
Deleted ! - C:\Documents and Settings\Muriel\Local Settings\Temporary Internet Files\Content.IE5\WZ44Z15U\servernames[1].htm
--------------- [ Registry / Infected keys ] ----------------
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\MsnMsgr
Deleted ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-1229272821-682003330-1801674531-1004\Software\MuleAppData
--------------- [ States / Restarting of services ] ----------------
+- Safe boot mode restored !
+- Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - Type of startup = 3
EapHost - Type of startup = 2
Ip6Fw - Type of startup = 2
SharedAccess - Type of startup = 2
wuauserv - Type of startup = 2
wscsvc - Type of startup = 2
--------------- [ Cleaning removable drives ] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur fixe
F: - Lecteur fixe
G: - Lecteur amovible
H: - Lecteur amovible
+- deleting files :
Not deleted !! - G:\autorun.inf
Deleted ! - H:\autorun.inf
--------------- [ Registry / Mountpoint2 ] ----------------
-> Not found !
--------------- [ Searching Other Infections ] ----------------
Références de comparaison Bagle MD5 :
113ac36b77630a2f67dd6cb7844406a4 C:\WINDOWS\system32\mdelk.exe
113ac36b77630a2f67dd6cb7844406a4 C:\WINDOWS\system32\wintems.exe
895c7dd60d43bc828d2355a956d9db27 C:\Documents and Settings\Muriel\Application Data\drivers\winupgro.exe
895c7dd60d43bc828d2355a956d9db27 C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
Suspect ! - 895c7dd60d43bc828d2355a956d9db27 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
--------------- [ Searching Cracks / Keygen ] ----------------
---------------- ! End of report ! ------------------
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 18:33
18 janv. 2009 à 18:33
Up, Help, please :)
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
18 janv. 2009 à 18:35
18 janv. 2009 à 18:35
Comment se comporte ton PC depuis le passage de FindiKill ?
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 18:36
18 janv. 2009 à 18:36
Plutot normalement, mais je ne peux toujours pas lancer avast-spybot et compagnie.... Que faire ? :s
Merci d'avance.
Merci d'avance.
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
18 janv. 2009 à 18:39
18 janv. 2009 à 18:39
Bagle a dû endommager Avast, il est possible que tu sois obligé de le réinstaller.
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 18:42
18 janv. 2009 à 18:42
Okay :) Donc je vais désinstaller Avast et Spybot, puis les ré-installer et normalement ce sera bon ?
Tout a été supprimé et ok ???
(vu les "deleted!")
Merci d'avance !
Tout a été supprimé et ok ???
(vu les "deleted!")
Merci d'avance !
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
18 janv. 2009 à 18:43
18 janv. 2009 à 18:43
N'oublie pas que Bagle est amené par les cracks.
Si tu en as, supprime-les sinon, ça risque de recommencer...
Si tu en as, supprime-les sinon, ça risque de recommencer...
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 18:45
18 janv. 2009 à 18:45
D'accord, je vais voir ça pour Illustrator et Photoshop.... (boulot donc crack oblige :s)
Mais merci infiniment !
tit.pat > Courage !
Mais merci infiniment !
tit.pat > Courage !
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 21:06
18 janv. 2009 à 21:06
Merci beaucoup, Toptitbal, tout est rentré dans l'ordre, j'ai ré-installé Avast et compagnie, pris toutes les mises à jour, vaccinations, j'ai également fait tous les scans possibles... Tout est niquel !!
Merci de l'aide !! Vraiment !!!
(la prochaine fois je n'irais plus chercher d'écran de veille... sur emule... :/ )
Merci de l'aide !! Vraiment !!!
(la prochaine fois je n'irais plus chercher d'écran de veille... sur emule... :/ )
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
18 janv. 2009 à 21:07
18 janv. 2009 à 21:07
Les cracks surtout qu'il faut éviter, Bagle vient de là....
souri2labo
Messages postés
9
Date d'inscription
dimanche 18 janvier 2009
Statut
Membre
Dernière intervention
18 janvier 2009
18 janv. 2009 à 21:10
18 janv. 2009 à 21:10
D'accord. :)
L'écran de veille, à l'origine, était payant sur le web (il fallait un code-clé d'activation-enregistrement)... Il devait y avoir un crack dans le pack... :s
L'écran de veille, à l'origine, était payant sur le web (il fallait un code-clé d'activation-enregistrement)... Il devait y avoir un crack dans le pack... :s
Bonsoir souri2labo, toptitbal
souri2labo, d'après le rapport FindyKill l'exe d'MSN s'est fait shooter par Bagle.
A moins bien sur que tu n'aies déjà réinstallé Windows Live, alors dans ce cas oublie ce qui suit :
Supprimes C:\Program Files\Windows Live\Messenger\msnmsgr.exe (S'il est infecté l'icone du fichier sera en forme de clé bleu)
Ensuite, ouvre le panneau de configuration -> Ajout/suppression de programmes -> Installation Windows Live -> Modifier/Supprimer -> Réparer
La procédure de réparation retéléchargera le fichier manquant et t'éviteras une réinstall totale du prog assez longuette :-).
Puis, si tu as redémarré ton pc alors que msnmsgr.exe était infecté, il est possible qu'un dossier relatif à l'infection se soit recrée (vide).
Vérifies et supprimes-le s'il s'avère qu'il existe :
Rends visible les fichiers cachés et système et recherche et supprime :
C:\Documents and Settings\Muriel\Application Data\drivers
Recaches ensuite les fichiers cachés et système.
Eventuellement si tu es à l'aise avec le registre, tu peux supprimer cette clé qui a du elle aussi être recrée en même temps que le dossier drivers:
HKEY_CURRENT_USER\Software\Bisoft
Démarrer > Executer > tape regedit et valide.
Déploies :
Et pour terminer, si tu utilises le Pare-feu de Windows, Ouvre le panneau de config -> Pare-feu Windows -> Onglet Exceptions -> Selectionnes et supprimes <gras Flec006</gras> s'il est mentionné.
(la prochaine fois je n'irais plus chercher d'écran de veille... sur emule... :/ )
Lol, il parait qu'il ne faut jamais dire jamais...Alors...Si jamais...Penses à te rendre sur ce site pour y faire analyser systématiquement les fichiers que tu ne téléchargeras plus, en plus d'un scan avec ton AV :-)
https://www.virustotal.com/gui/
Le fichier uploadé, sera soumis à une analyse simultanée par une quarantaine d'AV, ce qui à défaut d'être une solution, pourra te permettre d'éviter autant que possible le même genre de surprise que tu as eu avec Bagle :-)
Voilà, bonne continuation.
souri2labo, d'après le rapport FindyKill l'exe d'MSN s'est fait shooter par Bagle.
A moins bien sur que tu n'aies déjà réinstallé Windows Live, alors dans ce cas oublie ce qui suit :
Supprimes C:\Program Files\Windows Live\Messenger\msnmsgr.exe (S'il est infecté l'icone du fichier sera en forme de clé bleu)
Ensuite, ouvre le panneau de configuration -> Ajout/suppression de programmes -> Installation Windows Live -> Modifier/Supprimer -> Réparer
La procédure de réparation retéléchargera le fichier manquant et t'éviteras une réinstall totale du prog assez longuette :-).
Puis, si tu as redémarré ton pc alors que msnmsgr.exe était infecté, il est possible qu'un dossier relatif à l'infection se soit recrée (vide).
Vérifies et supprimes-le s'il s'avère qu'il existe :
Rends visible les fichiers cachés et système et recherche et supprime :
C:\Documents and Settings\Muriel\Application Data\drivers
Recaches ensuite les fichiers cachés et système.
Eventuellement si tu es à l'aise avec le registre, tu peux supprimer cette clé qui a du elle aussi être recrée en même temps que le dossier drivers:
HKEY_CURRENT_USER\Software\Bisoft
Démarrer > Executer > tape regedit et valide.
Déploies :
[+] HKEY_CURRENT_USER [-] Software |- Bisoft <- Clic dessus pour mettre en surbrillance puis clic droit, Supprimer.
Et pour terminer, si tu utilises le Pare-feu de Windows, Ouvre le panneau de config -> Pare-feu Windows -> Onglet Exceptions -> Selectionnes et supprimes <gras Flec006</gras> s'il est mentionné.
(la prochaine fois je n'irais plus chercher d'écran de veille... sur emule... :/ )
Lol, il parait qu'il ne faut jamais dire jamais...Alors...Si jamais...Penses à te rendre sur ce site pour y faire analyser systématiquement les fichiers que tu ne téléchargeras plus, en plus d'un scan avec ton AV :-)
https://www.virustotal.com/gui/
Le fichier uploadé, sera soumis à une analyse simultanée par une quarantaine d'AV, ce qui à défaut d'être une solution, pourra te permettre d'éviter autant que possible le même genre de surprise que tu as eu avec Bagle :-)
Voilà, bonne continuation.
toptitbal
Messages postés
25709
Date d'inscription
samedi 8 juillet 2006
Statut
Contributeur sécurité
Dernière intervention
4 mars 2010
2 228
18 janv. 2009 à 22:21
18 janv. 2009 à 22:21
Bonsoir moe
ça m'apprendra à ne pas faire trop de choses en même temps, je n'avais pas vu cela dans le rapport :
Suspect ! - 895c7dd60d43bc828d2355a956d9db27 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
Merci de ton intervention, bonne soirée.
ça m'apprendra à ne pas faire trop de choses en même temps, je n'avais pas vu cela dans le rapport :
Suspect ! - 895c7dd60d43bc828d2355a956d9db27 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
Merci de ton intervention, bonne soirée.