[Résolu] "Trojan-Downloader.Win32.Agent.bq" (sous Vista Ulti

xeniumproduction

Posté(e) le 31 août 2008

- Signaler

Posté(e) le 31 août 2008 (modifié)

Bonjour,

J'ai depuis peu de temps "Windows Security Alert" qui affiche ce message à intervalle régulier d'environ 2 a 5min et mon antivirus ne voit rien (voir image) :

J'ai également mon fond d'écran qui a changé et je ne peux le changer (après redémarrage mon fond d'écran est tout bleu) :

Voici mon rapport HiJackThis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:48:46, on 01/09/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Windows\SysWOW64\conime.exe

C:\Users\PcCoolerMaster\Desktop\AdobeFlashPlayerExt.exe

C:\Windows\SysWOW64\etujezcv.exe

C:\Windows\SysWOW64\cpszgpqv.exe

C:\Users\PcCoolerMaster\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm

O13 - Gopher Prefix:

O15 - Trusted Zone: http://asia.msi.com.tw

O15 - Trusted Zone: http://global.msi.com.tw

O15 - Trusted Zone: http://www.msi.com.tw

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab

O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Composant de commande centrale Trend Micro (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 9695 bytes

Merci d'avoir pris le temps de lire mon cas.

Modifié le 4 septembre 2008 par xeniumproduction

Citer

Falkra

Posté(e) le 1 septembre 2008

- Signaler

Posté(e) le 1 septembre 2008

Bonjour, système passablement infecté, en effet.

Le logiciel qui suit n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.

Ne pas utiliser en dehors de ce cas de figure ou seul : dangereux. Ceci n'est pas une solution miracle pour traiter ce problème.

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).

Assure toi que tous les programmes sont fermés avant de commencer.
Double-clique combofix.exe afin de l'exécuter.
Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
Il est possible que ton pare-feu (firewall) te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte.
Ne ferme pas la fenêtre qui vient de s'ouvrir, tu te retrouverais avec un bureau vide.
Lorsque l'analyse sera terminée, un rapport apparaîtra.
Copie-colle ce rapport dans ta prochaine réponse.
Le rapport se trouve dans : C:\Combofix.txt (si jamais).

Citer

xeniumproduction

Posté(e) le 1 septembre 2008

Auteur

- Signaler

Posté(e) le 1 septembre 2008

Le problème c'est que je suis sous Vista 64 et que Combofix.exe ne fonctionne que sous 2000 et XP.

J'ai cherché un peu et je suis tombé sur des sites en anglais. J'ai cru comprendre que c'était pas pour tout de suite.

En tout cas depuis que j'ai arrêter puis redémarrer mon pc, je n'ai plus ce message d'alerte qui apparait, en revanche je ne peux toujours pas changer de fond d'écran.

Quand je fais clique droit et personnaliser. Je n'ai plus afficher "Changer le fond d'écran", il a disparu ^^

Citer

Falkra

Posté(e) le 1 septembre 2008

- Signaler

Posté(e) le 1 septembre 2008

Vista ultimate x64, pas pour dire, mais ça sent le cracké (juste un peu de mauvais esprit bien sûr).

Et surtout, pourquoi 64bits ? Côté programmes, c'est pas la joie.

Télécharge Malwarebytes' Anti-Malware (MBAM)

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Sélectionne "Exécuter un examen rapide"
Clique sur "Rechercher"
L'analyse démarre, le scan est relativement long, c'est normal.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

NB : Si MBAM te demande à redémarrer, fais-le.

Citer

xeniumproduction

Posté(e) le 1 septembre 2008

Auteur

- Signaler

Posté(e) le 1 septembre 2008

Effectivement vos avez bien senti.

Pourquoi x64, c'est parce que j'ai un Q9550 avec plus de 3Go de Memoire vive.

Je crois que tout c'est bien passer je peux désormais rechanger mon fond d'écran.

Malwarebytes' Anti-Malware 1.25

Version de la base de données: 1103

Windows 6.0.6001 Service Pack 1

23:03:40 01/09/2008

mbam-log-09-01-2008 (23-03-40).txt

Type de recherche: Examen rapide

Eléments examinés: 33783

Temps écoulé: 1 minute(s), 38 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 25

Valeur(s) du Registre infectée(s): 4

Elément(s) de données du Registre infecté(s): 3

Dossier(s) infecté(s): 4

Fichier(s) infecté(s): 67

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):

C:\Windows\mslagent (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files (x86)\akl (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\System32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

C:\Windows\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Windows\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Windows\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files (x86)\akl\akl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files (x86)\akl\akl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files (x86)\akl\uninstall.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files (x86)\akl\unsetup.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Inet Delivery\intdel.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\System32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Windows\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\emesx.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\medup012.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\medup020.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\regc64.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\regm64.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\temp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully.

C:\Windows\System32\lphcvwnj0e15s.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Windows\System32\phcvwnj0e15s.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Merci encore.

Citer

Falkra

Posté(e) le 1 septembre 2008

- Signaler

Posté(e) le 1 septembre 2008

Effectivement vos avez bien senti.
Pourquoi x64, c'est parce que j'ai un Q9550 avec plus de 3Go de Memoire vive.

Je crois que tout c'est bien passer je peux désormais rechanger mon fond d'écran.

x64 n'apporte absolument rien de plus, voire moins de compatibilité. Ce n'est pas la même chose d'avoir un système 46bits et un processeur 64bits. Et cracké, c'est la mouise, tu as vu la quantité de saletés que MBAM a viré, déjà ? Combien viennent de sites de cracks, de keygens ou autres ? Un paquet sans doute...

Poste un nouveau rapport HijackThis stp.

Citer

xeniumproduction

Posté(e) le 2 septembre 2008

Auteur

- Signaler

Posté(e) le 2 septembre 2008

Je sais bien mais sous vista x32, seul 3Go de ma mémoire vive est vu au lieu des 4 que je dispose.

Voici le fameux rapport.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 07:50:14, on 02/09/2008