Piègé par Spyware Quake, Help

udolfo · le 2 octobre 2006

Yop yop

voila qui est fait

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

Monday, October 02, 2006 7:03:52 PM

Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 2/10/2006

Kaspersky Anti-Virus database records: 215152

-------------------------------------------------------------------------------

Scan Settings:

Scan using the following antivirus database: standard

Scan Archives: true

Scan Mail Bases: true

Scan Target - My Computer:

A:\

C:\

D:\

E:\

F:\

G:\

H:\

I:\

K:\

L:\

Scan Statistics:

Total number of scanned objects: 145478

Number of viruses found: 2

Number of infected objects: 5 / 0

Number of suspicious objects: 0

Duration of the scan process: 01:14:05

Infected Object Name / Virus Name / Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3fd20a676afddc079bee95e6afcc5e9f_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7cffe90875432d6d1e274c1c6bc09865_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\88ce334c3cc67ce99df2b089e83f3259_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a0baf4d2dde0c64df199794230129e1c_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bef6ec93e2a98f3b5cb3b0e4b9ca73fd_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bf9a7481e236a90bca2d9d464552518b_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

E:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

E:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

E:\Documents and Settings\François\Cookies\index.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

E:\Documents and Settings\François\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Historique\History.IE5\MSHist012006092520061002\index.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Historique\History.IE5\MSHist012006100220061003\index.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

E:\Documents and Settings\François\NTUSER.DAT Object is locked skipped

E:\Documents and Settings\François\ntuser.dat.LOG Object is locked skipped

E:\Documents and Settings\François\UserData\index.dat Object is locked skipped

E:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

E:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

E:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

E:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

E:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

E:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

E:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

E:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

E:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

E:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

E:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

E:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

E:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

E:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

E:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

E:\Program Files\Alwil Software\Avast4\DATA\report\Protection résidente.txt Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\BWDocMap.pht Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\BWInfopakMap.pht Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\chandir.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\chandir.idx Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\chn.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\chn.idx Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\D0000000.FCS Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\inuse.txt Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\L0000010.FCS Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\main.log Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs.idx Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_die.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_die.idx Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_dnd.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_dnd.idx Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_ext.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_ext.idx Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_rcv.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\prs_rcv.idx Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\storydb.dat Object is locked skipped

E:\Program Files\Logitech\Desktop Messenger\8876480\Users\François\Data\storydb.idx Object is locked skipped

E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

E:\System Volume Information\_restore{1F2D333E-EF67-4F44-814E-E46489AF0BDC}\RP1\change.log Object is locked skipped

E:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

E:\WINDOWS\SchedLgU.Txt Object is locked skipped

E:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

E:\WINDOWS\Sti_Trace.log Object is locked skipped

E:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

E:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

E:\WINDOWS\system32\config\default Object is locked skipped

E:\WINDOWS\system32\config\default.LOG Object is locked skipped

E:\WINDOWS\system32\config\SAM Object is locked skipped

E:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

E:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

E:\WINDOWS\system32\config\SECURITY Object is locked skipped

E:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

E:\WINDOWS\system32\config\software Object is locked skipped

E:\WINDOWS\system32\config\software.LOG Object is locked skipped

E:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

E:\WINDOWS\system32\config\system Object is locked skipped

E:\WINDOWS\system32\config\system.LOG Object is locked skipped

E:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped

E:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

E:\WINDOWS\system32\drivers\sptd8141.sys Object is locked skipped

E:\WINDOWS\system32\h323log.txt Object is locked skipped

E:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

E:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

E:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

E:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

E:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

E:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

E:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

E:\WINDOWS\Temp\Perflib_Perfdata_6a8.dat Object is locked skipped

E:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

E:\WINDOWS\wiadebug.log Object is locked skipped

E:\WINDOWS\wiaservc.log Object is locked skipped

E:\WINDOWS\WindowsUpdate.log Object is locked skipped

F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

F:\System Volume Information\_restore{AB4E6112-4A8C-4DE1-9F3C-BA8A15188F42}\RP338\A0070105.exe/stream/data0006 Infected: Trojan.Win32.Krepper.ag skipped

F:\System Volume Information\_restore{AB4E6112-4A8C-4DE1-9F3C-BA8A15188F42}\RP338\A0070105.exe/stream/data0007/data0002 Infected: Trojan-Downloader.Win32.IstBar.er skipped

F:\System Volume Information\_restore{AB4E6112-4A8C-4DE1-9F3C-BA8A15188F42}\RP338\A0070105.exe/stream/data0007 Infected: Trojan-Downloader.Win32.IstBar.er skipped

F:\System Volume Information\_restore{AB4E6112-4A8C-4DE1-9F3C-BA8A15188F42}\RP338\A0070105.exe/stream Infected: Trojan-Downloader.Win32.IstBar.er skipped

F:\System Volume Information\_restore{AB4E6112-4A8C-4DE1-9F3C-BA8A15188F42}\RP338\A0070105.exe NSIS: infected - 4 skipped

G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

K:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

regis56 · le 2 octobre 2006

Bonsoir udolfo !

Bien le système à l'air propre maintenant bien joué !

Cependant je ne sait pas pourquoi mais le système de restauration lui est toujours infecté ???

Tu ne dois pas faire comme il est noté :

-Créer un point de restauration et supprimer les anciens !: (aide visuelle http://assiste.free.fr/p/comment/comment_a...stauration.html )
Cliquer avec le bouton droit sur l'icône Poste de travail, puis cliquer sur Propriétés.

Cliquer sur l'onglet «Restauration du système».

Sélectionner «Désactiver la Restauration du système» ou «Désactiver la Restauration du système sur tous les lecteurs»

Cliquer sur Appliquer.

Comme le dit le message, ceci supprimera tous les points de restauration existants. Pour faire cela, cliquer sur Oui.

Cliquer sur OK, redémarrer le PC. Faire l'opération inverse, et réactiver la restauration:un nouveau point sera automatiquement créé.

Il faut vraimment suivre cette étape c'est très important sinon tu risque la réinfection...

N'hésite pas à suivre le tuto d'aide si besoin.

Et bien sur faire un scan en ligne pour vérifier que ca à marché !

A plus.

udolfo · le 7 octobre 2006

Yo regis,

voila qui est fait

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

Saturday, October 07, 2006 7:27:28 PM

Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 7/10/2006

Kaspersky Anti-Virus database records: 216559

-------------------------------------------------------------------------------

Scan Settings:

Scan using the following antivirus database: standard

Scan Archives: true

Scan Mail Bases: true

Scan Target - My Computer:

A:\

C:\

D:\

E:\

F:\

G:\

H:\

I:\

K:\

L:\

Scan Statistics:

Total number of scanned objects: 146259

Number of viruses found: 3

Number of infected objects: 8 / 0

Number of suspicious objects: 0

Duration of the scan process: 01:33:10

Infected Object Name / Virus Name / Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3fd20a676afddc079bee95e6afcc5e9f_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7cffe90875432d6d1e274c1c6bc09865_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\88ce334c3cc67ce99df2b089e83f3259_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a0baf4d2dde0c64df199794230129e1c_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bef6ec93e2a98f3b5cb3b0e4b9ca73fd_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bf9a7481e236a90bca2d9d464552518b_9a40dc41-ada2-45f9-9f83-48bf24e6c450 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped

C:\Documents and Settings\François\Éléments supprimés.dbx/[From "Scottferguson" <scottferguson@webbox.com>][Date Tue, 03 Oct 2006 18:31:27 +0100]/UNNAMED/html Infected: Email-Worm.Win32.Bagle.mail skipped

C:\Documents and Settings\François\Éléments supprimés.dbx/[From "Scottferguson" <scottferguson@webbox.com>][Date Tue, 03 Oct 2006 18:31:27 +0100]/UNNAMED Infected: Email-Worm.Win32.Bagle.mail skipped

C:\Documents and Settings\François\Éléments supprimés.dbx Mail MS Outlook 5: infected - 2 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

E:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

E:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

E:\Documents and Settings\François\Cookies\index.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

E:\Documents and Settings\François\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

E:\Documents and Settings\François\Local Settings\Historique\History.IE5\MSHist012006100720061008\index.dat Object is locked skipped