leifei

J'ai aussi réussi a le virer, avec SDfix comme l'a dis pear, jai tout fait comme il a dis, et pu de trace de ce virus sur mon pc, cool, mes contacts commencais a s'enerver lol ... résultats : SDfix >> ok Clean Virus MSN >> aparament ok msnfix >> pas ok hijackthis >> pas ok fsecure >> pas ok search & destroy >> pas ok

SDFix: Version 1.149 Run by FRED on 28/02/2008 at 20:17 Microsoft Windows XP [version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default HomePage Value Restoring Default Desktop Components Value Restoring Missing Security Center Service Rebooting Checking Files : Trojan Files Found: C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat - Contains Links to Malware Sites! - Deleted C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat - Contains Links to Malware Sites! - Deleted C:\Documents and Settings\FRED\Favoris\Error Cleaner.url - Deleted C:\Documents and Settings\FRED\Favoris\Privacy Protector.url - Deleted C:\Documents and Settings\FRED\Favoris\Spyware&Malware Protection.url - Deleted C:\WINDOWS\mrofinu1423.exe - Deleted C:\WINDOWS\mrofinu1423.exe.tmp - Deleted C:\DOCUME~1\FRED\LOCALS~1\Temp\winlogon.exe - Deleted C:\WINDOWS\monhop.exe - Deleted C:\WINDOWS\rs.txt - Deleted C:\WINDOWS\sawkip.exe - Deleted C:\WINDOWS\search_res.txt - Deleted C:\WINDOWS\system32\real.txt - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-28 20:24:15 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 68 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "D:\\Fred\\Jeux\\Nouveau dossier\\game.dat"="D:\\Fred\\Jeux\\Nouveau dossier\\game.dat:*:Enabled:La Bataille pour la Terre du Milieu" "C:\\DOCUME~1\\FRED\\LOCALS~1\\Temp\\winlogon.exe"="C:\\DOCUME~1\\FRED\\LOCALS~1\\Temp\\winlogon.exe:*:Enabled:Streams Drivers" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Sun 18 Nov 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 28 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT63.tmp" Sat 2 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT67.tmp" Finished! le winlogon est toujour dans les processus