Invasion de Trojan need helpFermé

Question

Bonjour,

J'ai ete infectee par n virus apres avoir clique sur un lien MSN :
http://viewpics.myphotos.cc/views.php?dir=pics§ion=hot&clip=14

Ce virus a envoye ce lien à tous mes contacts qui ont eux aussi ete infectes.

Depuis tous mes parametres de securite ont ete modifies, j'ai du mal à acceder à certain sites comme hotmail, yahoo. Ma version de msn a ete modifiee.

Il semble aussi que j'aie une invasion de trojan, mon antivirus n'arrete pas d'en attraper, voici la liste :

:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CTQNGDMJ\WEBSITE[1].OCX

Is the Trojan horse TR/Dldr.Agent.EX

C:\DOCUME~1\CARREF~1\LOCALS~1\TEMP\RARSFX1\RAR.EXE

Is the Trojan horse TR/Dldr.IstBar.IQ
C:\DOCUME~1\CARREF~1\LOCALS~1\TEMP\RARSFX1\VONNER.EXE

Is the Trojan horse TR/StartPage.nk.8.B

C:\TEMP\NCASEPACKAGE.EXE

Is the Trojan horse TR/Drop.180Soluti.A

C:\TEMP\OPTIMIZE.EXE

Is the Trojan horse TR/Dldr.Dyfuca.ds

C:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CTQNGDMJ\PROMPT[1].HTM

Contains signature of the HTML script virus HTML/IstBar.A.1

C:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CTQNGDMJ\WEBSITE[1].OCX

Is the Trojan horse TR/Dldr.Agent.EX

C:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\0LIN4T2F\JEEP3YD[1].JPG

Is the Trojan horse TR/LowZones.AN.1

C:\PROGRAM FILES\AVPERSONAL\INFECTED\JOCKER[1].EXE.VIR

Is the Trojan horse TR/StartPage.nk.7

On m'a conseille de faire un scan avec a²free, mais je ne sais pas si ce sera suffisant.

Y'a t-il autre chose à faire?

Dois-je supprimer les fichiers Trojen ou peut il s'agir de fichier systemes?

Que dois je faire d'autre?

Savez-vous quel est le nom d virus par lequel je suis infectee.

Merci milles fois pour vos reponses.

Neo-Nil@u · Answer

Salut Nathalie, utilise ce petit programme :http://pageperso.aol.fr/Balltrap34/CleanUp312.exeRelance un scan de ton antivirus ! Tiens-moi au courant !@+++

Utilisateur anonyme · Answer

salut nathalie et neo;et aussi:C:\PROGRAM FILES\AVPERSONAL\INFECTED\JOCKER[1].EXE.VIR celui ci est dans la quarantaine d antivir suis le chemin et supprime le, et vide ta corbeille !a+

Tchoupi51 · Answer

Bonjour,

J'ai le même problème que Nathalie, j'ai beau scanner, supprimer et rescanner après le démarrage de mon ordinateur, les virus revienne. J'ai essayé Antivir, spybot, adware...

Si qqun a une solution,
Merci

Utilisateur anonyme · Answer

slt tchoupic est quoi ton antivirus?ou te le detecte t il?a+

Tchoupi51 · Answer

C'est antivir mon antivirusLà il les delete à chaque fois mais il revienneIls se trouvent ici mais mon ordinateur ne trouve pas vonner.exeC:\DOCUME~1\PAULIN~1\LOCALS~1\TEMP\RARSFX0\VONNER.EXE

Utilisateur anonyme · Answer

slt,
vide tes fichiers temps et tempory internet file sur tous les utilisateur
utilise ceci pour le faire
http://pageperso.aol.fr/Balltrap34/CleanUp312.exe

redemarre ton ordi et tiens moi au courant

Tchoupi51 · Answer

Nathalie, je voulais savoir si tu étais débarrassée de tes virus, parce que moi je n'y arrive vraiment pas.Merci

balltrap34 · Answer

redemarre en mode sans echec
assure toi de ceci
Affiche tous les fichiers et dossiers :
cliquer sur démarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cacher

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décocher masquer les extensions dont le type est connu
Puis fais «Ok» pour valider les changements.

Et appliquer

recherche et suppr le fichier
C:\DOCUME~1\PAULIN~1\LOCALS~1\TEMP\RARSFX0\VONNER.EXE

vde ta poubelle redemarre et scan de verif

Tchoupi51 · Answer

SAlut,

Ca ne marche toujours pas.

Voici mon dernier scann avec Clean Up

C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Pauline00\Local Settings\Historique\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
'Typed URLs' (Internet Explorer) - removed from the registry.
C:\Documents and Settings\Pauline00\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Pauline00\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Pauline00\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Pauline00\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
'Run MRU' list - removed from the registry.
Paint Recent File List - removed from the registry.
WordPad Recent File List - removed from the registry.
Telnet's MRU list - removed from the registry.
CleanUp! recovered 0 bytes of disk space from 0 files.
CleanUp! finished on 05/21/05 19:08:45.

Ainsi que celui avec Ad Aware

Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Prior to deletion, allow unloading Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic settings in log file
Set : Include additional settings in log file
Set : Include reference summary in log file
Set : Include Alternate Datastream details in log file
Set : Play sound at scan completion if scan locates critical objects

21-05-2005 18:36:33 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\Pauline00\recent
Description : list of recently opened documents

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\adobe\acrobat reader\5.0\avgeneral\crecentfiles
Description : list of recently used files in adobe reader

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\kazaa\search
Description : list of recent searches performed with sharman networks kazaa

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\automap\8.0\findmru
Description : list of recently used find queries used in microsoft automap-based products

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\automap\8.0\recent file list
Description : list of recently used files in microsoft automap-based products

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X

MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\internet explorer\main
Description : last save directory used in microsoft internet explorer

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\recentfilelist
Description : list of recently used files in microsoft windows media player

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\recenturllist
Description : list of recently used web addresses in microsoft windows media player

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\settings
Description : last save as directory used in jasc paint shop pro

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\settings
Description : last open directory used in jasc paint shop pro

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\microsoft management console\recent file list
Description : list of recent snap-ins used in the microsoft management console

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\common\general
Description : list of recently used symbols in microsoft office

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\excel\recent files
Description : list of recent files used by microsoft excel

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\powerpoint\recent file list
Description : list of recent files used by microsoft powerpoint

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\powerpoint\recent templates
Description : list of recent templates used by microsoft powerpoint

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\powerpoint\recenttemplatelist
Description : list of recent templates used by microsoft powerpoint

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\search assistant\acmru
Description : list of recent search terms used with the search assistant

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\applets\regedit
Description : last key accessed using the microsoft registry editor

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

MRU List Object Recognized!
Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\winrar\dialogedithistory\extrpath
Description : winrar "extract-to" history

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 440
ThreadCreationTime : 21-05-2005 17:15:28
BasePriority : Normal

#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 492
ThreadCreationTime : 21-05-2005 17:15:31
BasePriority : Normal

#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 516
ThreadCreationTime : 21-05-2005 17:15:32
BasePriority : High

#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 560
ThreadCreationTime : 21-05-2005 17:15:35
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Système d'exploitation Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Applications Services et Contrôleur
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Tous droits réservés.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 572
ThreadCreationTime : 21-05-2005 17:15:35
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 728
ThreadCreationTime : 21-05-2005 17:15:39
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 780
ThreadCreationTime : 21-05-2005 17:15:40
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 844
ThreadCreationTime : 21-05-2005 17:15:41
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 968
ThreadCreationTime : 21-05-2005 17:15:43
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1032
ThreadCreationTime : 21-05-2005 17:15:44
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:11 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1360
ThreadCreationTime : 21-05-2005 17:15:50
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:12 [avguard.exe]
FilePath : C:\Program Files\AVPersonal\
ProcessID : 1656
ThreadCreationTime : 21-05-2005 17:15:57
BasePriority : Normal

#:13 [avwupsrv.exe]
FilePath : C:\Program Files\AVPersonal\
ProcessID : 1724
ThreadCreationTime : 21-05-2005 17:15:58
BasePriority : Normal

#:14 [ccevtmgr.exe]
FilePath : C:\Program Files\Fichiers communs\Symantec Shared\
ProcessID : 1768
ThreadCreationTime : 21-05-2005 17:15:59
BasePriority : Normal
FileVersion : 1.03.4
ProductVersion : 1.03.4
ProductName : Event Manager
CompanyName : Symantec Corporation
FileDescription : Event Manager Service
InternalName : ccEvtMgr
LegalCopyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : ccEvtMgr.exe

#:15 [mdm.exe]
FilePath : C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\
ProcessID : 1920
ThreadCreationTime : 21-05-2005 17:16:03
BasePriority : Normal
FileVersion : 7.00.9064.9150
ProductVersion : 7.00.9064.9150
ProductName : Microsoft Development Environment
CompanyName : Microsoft Corporation
FileDescription : Machine Debug Manager
InternalName : mdm.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1997-2000
OriginalFilename : mdm.exe

#:16 [navapsvc.exe]
FilePath : C:\Program Files\Norton AntiVirus\
ProcessID : 2016
ThreadCreationTime : 21-05-2005 17:16:06
BasePriority : Normal
FileVersion : 9.05.1015
ProductVersion : 9.05.1015
ProductName : Norton AntiVirus
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Auto-Protect Service
InternalName : NAVAPSVC
LegalCopyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : NAVAPSVC.EXE

#:17 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 2728
ThreadCreationTime : 21-05-2005 17:18:04
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe

#:18 [wscntfy.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 3420
ThreadCreationTime : 21-05-2005 17:32:28
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Security Center Notification App
InternalName : wscntfy.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : wscntfy.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

#:19 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 3092
ThreadCreationTime : 21-05-2005 17:32:28
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Système d'exploitation Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Explorateur Windows
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Tous droits réservés.
OriginalFilename : EXPLORER.EXE
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

#:20 [igfxtray.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 3716
ThreadCreationTime : 21-05-2005 17:32:29
BasePriority : Normal
FileVersion : 3,0,0,2104
ProductVersion : 7,0,0,2104
ProductName : Intel(R) Common User Interface
CompanyName : Intel Corporation
FileDescription : igfxTray Module
InternalName : IGFXTRAY
LegalCopyright : Copyright 1999-2003, Intel Corporation
OriginalFilename : IGFXTRAY.EXE
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

#:21 [hkcmd.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 3944
ThreadCreationTime : 21-05-2005 17:32:29
BasePriority : Normal
FileVersion : 3,0,0,2104
ProductVersion : 7,0,0,2104
ProductName : Intel(R) Common User Interface
CompanyName : Intel Corporation
FileDescription : hkcmd Module
InternalName : HKCMD
LegalCopyright : Copyright 1999-2003, Intel Corporation
OriginalFilename : HKCMD.EXE
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

#:22 [syntplpr.exe]
FilePath : C:\Program Files\Synaptics\SynTP\
ProcessID : 3824
ThreadCreationTime : 21-05-2005 17:32:29
BasePriority : Normal
FileVersion : 7.5.5 24Apr03
ProductVersion : 7.5.5 24Apr03
ProductName : Progressive Touch
CompanyName : Synaptics, Inc.
FileDescription : TouchPad Driver Helper Application
InternalName : SynTPLpr
LegalCopyright : Copyright (C) Synaptics, Inc. 1996-2003
OriginalFilename : SynTPLpr.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"Process terminated successfully

#:23 [syntpenh.exe]
FilePath : C:\Program Files\Synaptics\SynTP\
ProcessID : 980
ThreadCreationTime : 21-05-2005 17:32:29
BasePriority : Normal
FileVersion : 7.5.5 24Apr03
ProductVersion : 7.5.5 24Apr03
ProductName : Progressive Touch
CompanyName : Synaptics, Inc.
FileDescription : Synaptics TouchPad Enhancements
InternalName : Scrolleroo
LegalCopyright : Copyright (C) Synaptics, Inc. 1996-2003
OriginalFilename : SynTPEnh.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"Process terminated successfully

#:24 [launchap.exe]
FilePath : C:\Progra~1\Launch Manager\
ProcessID : 2540
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 1, 0, 0, 3
ProductVersion : 1, 0, 0, 3
ProductName : LaunchAp Application
FileDescription : LaunchAp MFC Application
InternalName : LaunchAp
LegalCopyright : Copyright (C) 2001
OriginalFilename : LaunchAp.EXE
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Progra~1\Launch Manager\LaunchAp.exe"Process terminated successfully

#:25 [powerkey.exe]
FilePath : C:\Progra~1\Launch Manager\
ProcessID : 976
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 1, 4, 4, 0
ProductVersion : 1, 4, 4, 0
FileDescription : Powerkey
InternalName : Powerkey
LegalCopyright : Copyright © 2001
OriginalFilename : Powerkey.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Progra~1\Launch Manager\PowerKey.exe"Process terminated successfully

#:26 [hotkeyapp.exe]
FilePath : C:\Progra~1\Launch Manager\
ProcessID : 788
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 1, 0, 4, 7
ProductVersion : 1, 0, 4, 7
ProductName : Wistron HotkeyApp
CompanyName : Wistron
FileDescription : HotkeyApp
InternalName : HotkeyApp
LegalCopyright : Copyright c 2002
OriginalFilename : HotkeyApp.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Progra~1\Launch Manager\HotkeyApp.exe"Process terminated successfully

#:27 [ctrlvol.exe]
FilePath : C:\Progra~1\Launch Manager\
ProcessID : 2304
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 1, 0, 0, 2
ProductVersion : 1, 0, 0, 2
ProductName : Wistron ctrlvol
CompanyName : Wistron
FileDescription : ctrlvol
InternalName : ctrlvol
LegalCopyright : Copyright c 2003
OriginalFilename : ctrlvol.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Progra~1\Launch Manager\CtrlVol.exe"Process terminated successfully

#:28 [wbutton.exe]
FilePath : C:\Progra~1\Launch Manager\
ProcessID : 2400
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 1, 0, 2, 4
ProductVersion : 1, 0, 2, 4
ProductName : WButton Application
FileDescription : WButton MFC Application
InternalName : WButton
LegalCopyright : Copyright (C) 2001
OriginalFilename : WButton.EXE
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Progra~1\Launch Manager\Wbutton.exe"Process terminated successfully

#:29 [almxptray.exe]
FilePath : C:\Program Files\Acer\Notebook Manager\
ProcessID : 2912
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 2.0.10.3
ProductVersion : 2.0.10
CompanyName : Acer
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Program Files\Acer\Notebook Manager\almxptray.exe"Process terminated successfully

#:30 [agrsmmsg.exe]
FilePath : C:\WINDOWS\
ProcessID : 1484
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 2.1.25 2.1.25 02/14/2003 11:58:58
ProductVersion : 2.1.25 2.1.25 02/14/2003 11:58:58
ProductName : Agere SoftModem Messaging Applet
CompanyName : Agere Systems
FileDescription : SoftModem Messaging Applet
InternalName : smdmstat.exe
LegalCopyright : Copyright © Agere Systems 1998-2000
OriginalFilename : smdmstat.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\WINDOWS\AGRSMMSG.exe"Process terminated successfully

#:31 [ltmoh.exe]
FilePath : C:\Program Files\ltmoh\
ProcessID : 2612
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 1.68
ProductVersion : 1.68
ProductName : LtMoh Application
CompanyName : Agere Systems
FileDescription : LtMoh MFC Application
InternalName : LtMoh
LegalCopyright : Agere Copyright © 2001-2002
LegalTrademarks : LT
OriginalFilename : LtMoh.EXE
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Program Files\ltmoh\Ltmoh.exe"Process terminated successfully

#:32 [ccapp.exe]
FilePath : C:\Program Files\Fichiers communs\Symantec Shared\
ProcessID : 2208
ThreadCreationTime : 21-05-2005 17:32:30
BasePriority : Normal
FileVersion : 1.08.01
ProductVersion : 1.08.01
ProductName : Common Client
CompanyName : Symantec Corporation
FileDescription : Common Client CC App
InternalName : ccApp
LegalCopyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : ccApp.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

#:33 [hpztsb10.exe]
FilePath : C:\WINDOWS\System32\spool\drivers\w32x86\3\
ProcessID : 4004
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal
FileVersion : 2.323.0.0
ProductVersion : 2.323.0.0
ProductName : HP DeskJet
CompanyName : HP
LegalCopyright : Copyright (c) Hewlett-Packard Company 1999-2004
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe"Process terminated successfully

#:34 [hpwuschd2.exe]
FilePath : C:\Program Files\Hewlett-Packard\HP Software Update\
ProcessID : 2908
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal
FileVersion : 3, 0, 38, 1
ProductVersion : 3, 0, 38, 1
ProductName : HP Software Update Application
CompanyName : Hewlett-Packard Company
FileDescription : hpwuSchd
InternalName : hpwuSchd
LegalCopyright : Copyright © 2003
OriginalFilename : hpwuSchd.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"Process terminated successfully

#:35 [hpcmpmgr.exe]
FilePath : C:\Program Files\HP\hpcoretech\
ProcessID : 1284
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal
FileVersion : 2.1.1.0
ProductVersion : 2.1.4
ProductName : hp coretech (COmponent REuse TECHnology)
CompanyName : Hewlett-Packard Company
FileDescription : HP Framework Component Manager Service
InternalName : HPComponentManagerService module
LegalCopyright : Copyright (C) Hewlett-Packard. 2002-2003
OriginalFilename : HpCmpMgr.exe
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

#:36 [avgnt.exe]
FilePath : C:\Program Files\AVPersonal\
ProcessID : 2496
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal

Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Program Files\AVPersonal\AVGNT.EXE"Process terminated successfully

#:37 [msnmsgrs.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 4076
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal

#:38 [mediaacck.exe]
FilePath : C:\Program Files\Media Access\
ProcessID : 3808
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal

Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

"C:\Program Files\Media Access\MediaAccK.exe"Process terminated successfully

#:39 [ap9h4qmo.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 2308
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\ap9h4qmo.exe)

SahAgent Object Recognized!
Type : Process
Data : ap9h4qmo.exe
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4

"C:\WINDOWS\system32\ap9h4qmo.exe"Process terminated successfully
"C:\WINDOWS\system32\ap9h4qmo.exe"Process terminated successfully

#:40 [mediaaccess.exe]
FilePath : C:\Program Files\Media Access\
ProcessID : 2720
ThreadCreationTime : 21-05-2005 17:32:31
BasePriority : Normal
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
ProductName : LoaderX Module
FileDescription : LoaderX Module
InternalName : LoaderX
LegalCopyright : Copyright 2005
OriginalFilename : LoaderX.EXE

WindUpdates Object Recognized!
Type : Process
Data : MediaAccess.exe
Category : Malware
Comment : (CSI MATCH)
Object : C:\Program Files\Media Access\
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
ProductName : LoaderX Module
FileDescription : LoaderX Module
InternalName : LoaderX
LegalCopyright : Copyright 2005
OriginalFilename : LoaderX.EXE

Warning! WindUpdates Object found in memory(C:\Program Files\Media Access\MediaAccess.exe)

"C:\Program Files\Media Access\MediaAccess.exe"Process terminated successfully
Warning! "C:\Program Files\Media Access\MediaAccess.exe"Process could not be terminated!

#:41 [ctfmon.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 356
ThreadCreationTime : 21-05-2005 17:32:32
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:42 [spybotsd.exe]
FilePath : C:\Program Files\Spybot - Search & Destroy\
ProcessID : 2252
ThreadCreationTime : 21-05-2005 17:35:24
BasePriority : Normal
FileVersion : 1, 3, 0, 12
ProductVersion : 1, 3, 0, 12
ProductName : SpyBot-S&D
CompanyName : Safer Networking Limited
FileDescription : Spybot - Search & Destroy
InternalName : SpybotSD
LegalCopyright : © 2000-2004 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten.
LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.
OriginalFilename : SpyBotSD.exe
Comments : Software zum Entfernen von Spyware und ähnlichen Bedrohungen.

#:43 [ad-aware.exe]
FilePath : C:\Documents and Settings\Pauline00\Mes documents\Mes fichiers reçus\
ProcessID : 224
ThreadCreationTime : 21-05-2005 17:36:20
BasePriority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

SahAgent Object Recognized!
Type : Process
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 2
Objects found so far: 55

Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

SahAgent Object Recognized!
Type : RegKey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\winsock2\layered provider sample

Registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 1
Objects found so far: 56

Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

SahAgent Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment : "ap9h4qmo"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Run
Value : ap9h4qmo

SahAgent Object Recognized!
Type : File
Data : ap9h4qmo.exe
Category : Data Miner
Comment :
Object : c:\windows\system32\
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 1
Objects found so far: 58

Started tracking cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 58

Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

WindUpdates Object Recognized!
Type : File
Data : ide21201.vxd
Category : Malware
Comment :
Object : C:\WINDOWS\system32\

SahAgent Object Recognized!
Type : File
Data : q17i9a4j.exe
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 3, 0, 0, 3
ProductVersion : 3, 0, 0, 3

SahAgent Object Recognized!
Type : File
Data : qh4mkbv9.dll
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

SahAgent Object Recognized!
Type : File
Data : a95kfrhe.exe
Category : Data Miner
Comment :
Object : C:\WINDOWS\
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4

SahAgent Object Recognized!
Type : File
Data : A0003780.dll
Category : Data Miner
Comment :
Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

SahAgent Object Recognized!
Type : File
Data : A0003782.exe
Category : Data Miner
Comment :
Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
FileVersion : 3, 0, 0, 3
ProductVersion : 3, 0, 0, 3

SahAgent Object Recognized!
Type : File
Data : A0003783.EXE
Category : Data Miner
Comment :
Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4

SahAgent Object Recognized!
Type : File
Data : A0003784.exe
Category : Data Miner
Comment :
Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4

WindUpdates Object Recognized!
Type : File
Data : A0003787.vxd
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\

Disk scan result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 67

Deep scanning and examining files (D:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk scan result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 67

Scanning Hosts file...
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New Critical Objects:0
Objects found so far: 67

Performing conditional scans..
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

SahAgent Object Recognized!
Type : File
Data : ap2nqrd4.dat
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\

SahAgent Object Recognized!
Type : File
Data : ap9h4qmo.ini
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\

SahAgent Object Recognized!
Type : File
Data : baur5s9q.dat
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\

SahAgent Object Recognized!
Type : File
Data : bqrufs5f.dat
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\

SahAgent Object Recognized!
Type : File
Data : q10pvbrv.dat
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\

SahAgent Object Recognized!
Type : File
Data : ritsacnk.dat
Category : Data Miner
Comment :
Object : C:\WINDOWS\system32\

WindUpdates Object Recognized!
Type : RegKey
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\media access

WindUpdates Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\media access
Value : UninstallString

WindUpdates Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\media access
Value : DisplayName

WindUpdates Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\run
Value : Media Access

WindUpdates Object Recognized!
Type : Folder
Category : Malware
Comment :
Object : C:\Program Files\Media Access

WindUpdates Object Recognized!
Type : File
Data : MediaAccC.dll
Category : Malware
Comment :
Object : C:\Program Files\media access\

WindUpdates Object Recognized!
Type : File
Data : MediaAccK.exe
Category : Malware
Comment :
Object : C:\Program Files\media access\

WindUpdates Object Recognized!
Type : File
Data : Info.txt
Category : Malware
Comment :
Object : C:\Program Files\media access\

WindUpdates Object Recognized!
Type : File
Data : MediaAccess.exe
Category : Malware
Comment :
Object : C:\Program Files\media access\
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
ProductName : LoaderX Module
FileDescription : LoaderX Module
InternalName : LoaderX
LegalCopyright : Copyright 2005
OriginalFilename : LoaderX.EXE

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 15
Objects found so far: 82

18:57:13 Scan Complete

Summary of this scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:20:39.933
Objects scanned:93511
Objects identified:29
Objects ignored:0
New Critical Objects:29

J'aimerais vraiment arriver à supprimer ce truc C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index

ainsi que tous les autres d'ailleurs

Merci d'avance

balltrap34 · Answer

clen up a fait son travail et il te dit qu il les suppr au redemarrage
Faite scan en ligne et coller le rapport ici sur le post
utiliser l'antivirus en ligne suivant :
http://www.ravantivirus.com/scan/
Cliquer sur "To continue without subscribing click here" et attendre quelques minutes.

Lorsque "Ready" est affiché dans "status", cocher la case "Autoclean" puis cliquer sur "Scan my PC"
A la fin de l'analyse, copier/coller le rapport ici.

braïce · Answer

bonjours a toi natalie il parai evident que ton pc est dans un vilaine etat.. il me parait difficil de tout supprimé et de repartir comme si ne rien etai donc en vu de ta liste enorme de fichier infecté le mieu a faire est de formater ( supprimé la totalité du disque dur) tu n'aura qu'a ré-instalé windows si tu a tjr le cd....
cette solution te virera a coup sur la totalité des virus spyware trojan ver bref tout tout tout

pour sauvegardé tes document fai un scan sur "mes documents" et si il n'y a rien sauvegarde les sur cd ensuite tu redemare ton pc en mettan le cd windows dedan tu n'a plus qu'a suivre les instruction

je repasserai voir si tu ten est tiré ++

Invasion de Trojan need help

11 réponses

Discussions similaires

Newsletters