Bonjour,
depuis aujourd'hui j'ai une fenetre qui s'ouvre win7 home security 2012 firewall alert.
Je suis venu voir sur le forum et j'ai telechargé roguekiller voici le rapport lorsque je tape 1
RogueKiller V6.2.3 [09/01/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur: ANAIS [Droits d'admin]
Mode: Recherche -- Date : 10/01/2012 08:27:46
¤¤¤ Processus malicieux: 2 ¤¤¤
[WINDOW : Win 7 Internet Security 2012] exr.exe -- C:\Users\ANAIS\AppData\Local\exr.exe -> KILLED [TermProc]
[SUSP PATH] exr.exe -- C:\Users\ANAIS\AppData\Local\exr.exe -> KILLED [TermProc]
¤¤¤ Entrees de registre: 10 ¤¤¤
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[FILEASSO] HKCU\[...]Software\Classes\.exe\shell\open\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "%1" %*) -> FOUND
[FILEASSO] HKCR\[...].exe\shell\open\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "%1" %*) -> FOUND
[FILEASSO] HKCR\.exe : (cl) -> FOUND
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") -> FOUND
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) -> FOUND
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") -> FOUND
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [NOT LOADED] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-AH|ZeroAccess ¤¤¤
[ZeroAccess] sys32\consrv.dll present!
¤¤¤ Fichier HOSTS: ¤¤¤
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] cf21211404104024d0b0535b6368edee
[BSP] b8e681ec20f3f51e484d81d4ade624cc : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 2048 | Size: 104 Mo
1 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 206848 | Size: 500000 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 346058a5405d7640af2af52e3b13b18c
[BSP] e6c2cebec9d5914c6fe029aa4b621d92 : Windows Vista/7 MBR Code
Partition table:
0 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 2048 | Size: 250042 Mo
1 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 488366080 | Size: 250061 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Termine : << RKreport[1].txt >>
RKreport[1].txt--
et lorsque je tape 2
RogueKiller V6.2.3 [09/01/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur: ANAIS [Droits d'admin]
Mode: Suppression -- Date : 10/01/2012 08:32:41
¤¤¤ Processus malicieux: 0 ¤¤¤
¤¤¤ Entrees de registre: 9 ¤¤¤
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[FILEASSO] HKCU\[...]Software\Classes\.exe\shell\open\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "%1" %*) -> REPLACED ("%1" %*)
[FILEASSO] HKCR\[...].exe : (cl) -> REPLACED (exefile)
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") -> REPLACED ()
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) -> REPLACED ( -safe-mode)
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command : ("C:\Users\ANAIS\AppData\Local\exr.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") -> REPLACED ("C:\Program Files (x86)\internet explorer\iexplore.exe")
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [NOT LOADED] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-AH|ZeroAccess ¤¤¤
[ZeroAccess] sys32\consrv.dll present!
¤¤¤ Fichier HOSTS: ¤¤¤
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] cf21211404104024d0b0535b6368edee
[BSP] b8e681ec20f3f51e484d81d4ade624cc : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 2048 | Size: 104 Mo
1 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 206848 | Size: 500000 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 346058a5405d7640af2af52e3b13b18c
[BSP] e6c2cebec9d5914c6fe029aa4b621d92 : Windows Vista/7 MBR Code
Partition table:
0 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 2048 | Size: 250042 Mo
1 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 488366080 | Size: 250061 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
Quelqu'un peut-il m'aider s'il vous plait d'avance merci beaucoup
je n'suis pas à moitié aussi sérieuse que j'en ai l'air quand je ne suis pas sérieuse!
