Bonjour ,

télécharge ca http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Télécharge le sur le bureau

-
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

-Redémarre ton ordinateur
-Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
-A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
-Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
-Choisis ton compte.
-Déroule la liste des instructions ci-dessous :
-Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
-Appuie sur Y pour commencer le processus de nettoyage.
-Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
-Appuie sur une touche pour redémarrer le PC.
-Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
-Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
-Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
-Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Salut ,ca marche la solution kil a donné?

J'ai le même virus ("c'est vraiment toi ça?"), il s'envoie tout seul à tous mes contacts en ligne (qui se font avoir aussi)
Je ne sais pas comment m'en débarrasser... Cette technique fonctionne t-elle vraiment? Sans danger?
AIDEZ MOI SVP! merci!

Oui

Voila j'ai le meme virus je ben15 je tenvoie mon report.exe voila :


Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 21:34:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

C:\Documents and Settings\Admin\qkaetqpp.exe [696] 0x8572D990

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 1
hidden services: 0
hidden files: 48


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Disabled:Morpheus"
"C:\\Program Files\\utorrent\\utorrent.exe"="C:\\Program Files\\utorrent\\utorrent.exe:*:Disabled:æTorrent"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\eMule\\eMule.exe"="C:\\Program Files\\eMule\\eMule.exe:*:Enabled:eMule Plus"
"C:\\DOCUME~1\\Admin\\LOCALS~1\\Temp\\dllhost.exe"="C:\\DOCUME~1\\Admin\\LOCALS~1\\Temp\\dllhost.exe:*:Enabled:Flash Media"
"C:\\Documents and Settings\\Admin\\qkaetqpp.exe"="C:\\Documents and Settings\\Admin\\qkaetqpp.exe:*:Enabled:Flash Media"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

Thu 5 Aug 2004 94,864 ..SH. --- "C:\WINDOWS\twain.dll"
Thu 5 Aug 2004 50,688 ..SH. --- "C:\WINDOWS\twain_32.dll"
Thu 5 Aug 2004 1,028,096 ..SH. --- "C:\WINDOWS\system32\mfc42.dll"
Thu 5 Aug 2004 54,784 ..SH. --- "C:\WINDOWS\system32\msvcirt.dll"
Thu 5 Aug 2004 413,696 ..SH. --- "C:\WINDOWS\system32\msvcp60.dll"
Thu 5 Aug 2004 343,040 ..SH. --- "C:\WINDOWS\system32\msvcrt.dll"
Thu 17 May 2007 549,376 ..SH. --- "C:\WINDOWS\system32\oleaut32.dll"
Thu 5 Aug 2004 83,456 ..SH. --- "C:\WINDOWS\system32\olepro32.dll"
Thu 5 Aug 2004 12,288 ..SH. --- "C:\WINDOWS\system32\regsvr32.exe"
Tue 19 Dec 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 3 Aug 2007 2,498,560 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL0002.tmp"
Mon 4 Nov 2002 1,678,848 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL0745.tmp"
Sat 2 Nov 2002 1,597,952 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL0935.tmp"
Sat 2 Nov 2002 1,498,624 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL1335.tmp"
Sat 17 Sep 2005 26,112 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL1776.tmp"
Sat 2 Nov 2002 1,596,928 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2069.tmp"
Thu 11 Apr 2002 190,976 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2112.tmp"
Mon 20 May 2002 19,968 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2255.tmp"
Tue 19 Apr 2005 19,456 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2292.tmp"
Tue 5 Nov 2002 697,344 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2313.tmp"
Thu 11 Apr 2002 189,440 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2432.tmp"
Sat 2 Nov 2002 1,598,464 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2462.tmp"
Sat 2 Nov 2002 20,480 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2703.tmp"
Tue 5 Nov 2002 1,677,312 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL2789.tmp"
Thu 11 Apr 2002 188,416 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL3105.tmp"
Sat 2 Nov 2002 1,597,440 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL3186.tmp"
Sat 2 Nov 2002 1,598,464 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL3579.tmp"
Fri 16 Sep 2005 21,504 A..H. --- "C:\Documents and Settings\Admin\Mes documents\Dossier christiane et kjell\~WRL3833.tmp"
Sat 18 Nov 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 13 Nov 2004 37,376 ...H. --- "C:\Program Files\Fichiers communs\Adobe\ESD\DLMCleanup.exe"
Wed 30 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT2.tmp"
Wed 19 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\778fd2fc3fe6b905e366b5ddbba384c8\BITA.tmp"

Finished!

[b][u]SDFix: Version 1.144/u/b

Run by maureen on 20/02/2008 at 14:37

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\maureen\Bureau\SDFix

[b][u]Checking Services/u/b:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


[b][u]Checking Files/u/b:

Trojan Files Found:

C:\WINDOWS\photos.zip - Deleted
C:\DOCUME~1\maureen\LOCALS~1\Temp\dllhost.exe - Deleted





Removing Temp Files...

[b][u]ADS Check/u/b:



[b][u]Final Check/u/b:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 14:43:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

C:\Documents and Settings\maureen\jqvmezjf.exe [764] 0x822D8670

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 1
hidden services: 0
hidden files: 63


[b][u]Remaining Services/u/b:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"="C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"="C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\\Program Files\\Shareaza\\Shareaza.exe"="C:\\Program Files\\Shareaza\\Shareaza.exe:*:Enabled:Shareaza"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Documents and Settings\\frank\\jqvmezjf.exe"="C:\\Documents and Settings\\frank\\jqvmezjf.exe:*:Enabled:Flash Media"
"C:\\Documents and Settings\\maureen\\jqvmezjf.exe"="C:\\Documents and Settings\\maureen\\jqvmezjf.exe:*:Enabled:Flash Media"
"C:\\Documents and Settings\\pascale\\jqvmezjf.exe"="C:\\Documents and Settings\\pascale\\jqvmezjf.exe:*:Enabled:Flash Media"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b][u]Remaining Files/u/b:


File Backups: - C:\DOCUME~1\maureen\Bureau\SDFix\backups\backups.zip

[b][u]Files with Hidden Attributes/u/b:

Tue 29 May 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 16 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\388e66e644283db0233c4a98f2fd08a0\BIT2.tmp"
Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT1.tmp"
Tue 29 May 2007 4,348 ...H. --- "C:\Documents and Settings\frank\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Fri 9 Nov 2007 20 A..H. --- "C:\Documents and Settings\frank\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Fri 7 Sep 2007 9,856 A.SH. --- "C:\Documents and Settings\frank\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished!/b

J ai chopé le meme virus voila le resultat : (merci par avance de la reponse)



[b]SDFix: Version 1.146 /b

Run by Administrateur on 24/02/2008 at 21:41

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files /b:

No Trojan Files Found






Removing Temp Files

[b]ADS Check /b:



[b]Final Check /b:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 21:44:18
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogon.exe [488] 0x89B67DA0

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 1
hidden services: 0
hidden files: 0


[b]Remaining Services /b:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\shared­access\parameters\firewallpolicy\standardprofile\authorizeda­pplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\MSMSGS.EXE"="C:\\Program Files\\Messenger\\MSMSGS.EXE:*:Enabled:Windows Messenger"
"C:\\ancien disque\\Program Files\\BitComet\\BitComet.exe"="C:\\ancien disque\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Documents and Settings\\utilisateur\\Bureau\\BitComet.exe"="C:\\Documents and Settings\\utilisateur\\Bureau\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"="C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe:*:Enabled:Veoh Client"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\DOCUME~1\\UTILIS~1\\LOCALS~1\\Temp\\winlogon.exe"="C:\\DOCUME~1\\UTILIS~1\\LOCALS~1\\Temp\\winlogon.exe:*:Enabled:Flash Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files /b:



[b]Files with Hidden Attributes /b:

Wed 20 Feb 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9e870549834e2bceb796e44a1e3ac6f5\BIT8.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\22fb973e059470cc1b5d76c4ae605351\BIT9.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2769b111678c52099a3b3123b12f2325\BIT6.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT5.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT1.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\30285791903730fbf957a83562db4ff4\BIT3.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d77b9b5b8fed23dd91f50d167cce60d3\BIT7.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb8921d0c7830b2f33c00fa4c8a10d17\BIT4.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT2.tmp"
Sun 11 Nov 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished!/b

Pour supprimer le virus naked, tu fais comme indiqué la dessus :
- http://www.msncreative.net/...