Bonjour,
Moi aussi je viens d'attraper ce petit coquin.
Je viens de faire un scan Rkill et un autre RogueKiller 1 recherche
Qu'en pensez vous?
Que dois je faire? lancer la suppression?
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Rkill was run on 17/01/2012 at 19:22:55.
Operating System: Microsoft Windows XP
Processes terminated by Rkill or while it was running:
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\qkm.exe
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\combroadcaster\combroadcaster.exe
C:\Documents and Settings\Propriétaire\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\safeupdater\SafeUpdater.exe
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\qkm.exe
Rkill completed on 17/01/2012 at 19:23:01.
dois je supprimer le repertoire RK_Quarantine?
RogueKiller V6.2.4 [12/01/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: Propriétaire [Droits d'admin]
Mode: Recherche -- Date : 17/01/2012 19:24:06
¤¤¤ Processus malicieux: 1 ¤¤¤
[ROGUE ProgFiles] eorezo.exe -- C:\Program Files\EoRezo\eorezo.exe -> KILLED [TermProc]
¤¤¤ Entrees de registre: 7 ¤¤¤
[ROGUE ProgFiles] HKLM\[...]\Run : EoEngine ("C:\Program Files\EoRezo\EoEngine.exe") -> FOUND
[SUSP PATH] HKLM\[...]\Run : SoftwareHelper (C:\Documents and Settings\Propriétaire\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe) -> FOUND
[ROGUE ProgFiles] HKLM\[...]\Run : eorezo ("C:\Program Files\EoRezo\eorezo.exe") -> FOUND
[SUSP PATH] HKLM\[...]\Run : combroadcaster ("C:\Documents and Settings\Propriétaire\Local Settings\Application Data\combroadcaster\combroadcaster.exe") -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [LOADED] ¤¤¤
¤¤¤ Infection : Rogue.ProgFiles ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 166404217032eaf10d0676a7a108f7a9
[BSP] 157711fd48a9113b5c992ce072385fa1 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 63 | Size: 104855 Mo
1 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 204796620 | Size: 395249 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 6df5f1d887f18a10d10128b4bfb89b97
[BSP] d5b612477a506751690493aacec1179e : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 63 | Size: 31453 Mo
1 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 61432560 | Size: 132468 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[1].txt >>
RKreport[1].txt
merci de votre aide
Jeff
