Virus, probablement attrapé sur MSN

[Thib344]

Bonjour tout le monde,

 

Voila mon histoire: Hier soir, (vendredi) mon PC a eu un comportement étrange. La souris se bloquait (et ne se débloquait qu'en effectuant la manip ctrl+alt+suppr) l'écran devenait blanc par moment etc etc.

J'ai alors quitté msn, et tout s'est arrangé. Problème alors, comment utiliser msn sans être dérangé ?

Dans la nuit, j'ai reçu plusieurs mails m'indiquant que mon pC avait envoyé des messages à tous mes contacts... bonne surprise au réveil

A l'époque (hier ^^) j'utilisais Avira, mais après un scan complet, il n'a rien trouvé d'anormal. J'ai téléchargé l'antivirus d'AVG, et il m'a débarrassé de pas mal de saleté, seulement, msn est toujours inutilisable.

 

Par précaution, j'ai changé mon mot de passe de messagerie... et là, impossible de me connecter il m'indique l'erreur je n'sais plus combien

 

J'ai donc fais un scan HijackThis et voici le rapport: (merci d'avance )

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:38:29, on 20/09/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS2\System32\smss.exe

C:\WINDOWS2\system32\csrss.exe

C:\WINDOWS2\system32\winlogon.exe

C:\WINDOWS2\system32\services.exe

C:\WINDOWS2\system32\lsass.exe

C:\WINDOWS2\system32\Ati2evxx.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\System32\svchost.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\system32\Ati2evxx.exe

C:\WINDOWS2\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS2\Explorer.EXE

C:\WINDOWS2\msnmsgrs.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS2\system32\ctfmon.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\IObit\IObit Security 360\IS360srv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\System32\alg.exe

C:\WINDOWS2\System32\svchost.exe

C:\WINDOWS2\system32\wuauclt.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\PROGRA~1\AVG\AVG8\avgam.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\WINDOWS2\explorer.exe

C:\WINDOWS2\avgouard.exe

C:\DOCUME~1\THIBAU~1.XPS\LOCALS~1\Temp\IXP002.TMP\livemsn.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\AVG\AVG8\avgui.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Thibaut.XPSP2-09CDFA9CC\Mes documents\Downloads\KARCHER-HJ.exe

C:\WINDOWS2\system32\wbem\wmiprvse.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://board.ikariam.fr/index.php?page=Indexa67627a5

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

F2 - REG:system.ini: UserInit=c:\windows2\system32\userinit.exe,C:\WINDOWS2\system32\MPK\MPK.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [iObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Messenger Update] msnmsgrs.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Windows Rundll Center] avgouard.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')

O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O15 - Trusted Zone: *.chat-land.org

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGam...1/GAME_UNO1.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfi...fig_3_5_1_0.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS2\SYSTEM32\avgrsstx.dll

O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS2\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS2\system32\ati2sgag.exe

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

 

--

End of file - 9975 bytes

[pear]

Bonjour,

 

Télécharger sur le bureauOTM by OldTimer .

Double-clic sur OTM.exe pour le lancer.

Sous Vista,Clic droit sur le fichier ->Choisir Exécuter en tant qu' Administrateur

Vérifier que Unregister Dll's and Ocx's soit coché.

* Copiez /Collez les lignes ci dessous):

 

:Processes

:Files

C:\WINDOWS2\msnmsgrs.exe

:Services

:Reg

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Windows Rundll Center"=-

:Commands

[purity]

[emptytemp]

[start explorer]

[Reboot]

 

Revenez dans OTM,

Clic droit sur la fenêtre "Paste Instructions for Items to be Moved" sous la barre jaune et choisir Coller(Paste).

* Click le bouton rouge Moveit!

* Fermez OTM

Votre Pc va redémarrer.

Rendez vous dans le dossier C:\_OTM\MovedFiles ,

ouvrez le dernier fichier .log

Copiez/collez en le contenu dans votre prochaine réponse

 

 

Téléchargez MBAM

 

Branchez tous les supports amovibles avant de faire ce scan (clé usb/disque dur externe etc)

Si vous utilisez Spybot

Pour désactiver TeaTimer qui ne set à rien et peut faire échouer une désinfection:!

Afficher d'abord le Mode Avancé dans SpyBot

->Options Avancées :

- >menu Mode, Mode Avancé.

Une colonne de menus apparaît dans la partie gauche :

- >cliquer sur Outils,

- >cliquer sur Résident,

Dans Résident :

- >décocher Résident "TeaTimer" pour le désactiver.

* Double cliquez sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation.

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet)

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

Vérifiez que les options Update et Launch soient cochées

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue..

* Dans l'onglet "mise à jour", cliquez sur le bouton Recherche de mise à jour:

Si le pare-feu demande l'autorisation à MBAM de se connecter, acceptez.

* Une fois la mise à jour terminée, allez dans l'onglet Recherche.

* Sélectionnez "Exécuter un examen complet"

* Cliquez sur "Rechercher"

* .L' analyse prendra un certain temps, soyez patient !

* A la fin , un message affichera :

L'examen s'est terminé normalement.

 

*Si MBAM n'a rien trouvé, il le dira aussi.

Cliquez sur "Ok" pour poursuivre.

*Fermez les navigateurs.

Cliquez sur Afficher les résultats .

 

*Sélectionnez tout et cliquez sur Supprimer la sélection ,

MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

puis ouvrir le Bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

* Copiez-collez ce rapport dans la prochaine réponse.

[Thib344]

Rapport de OTM:

 

All processes killed

========== PROCESSES ==========

========== FILES ==========

C:\WINDOWS2\msnmsgrs.exe moved successfully.

========== SERVICES/DRIVERS ==========

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Rundll Center not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrateur

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->FireFox cache emptied: 2468735 bytes

 

User: All Users

 

User: All Users.WINDOWS2

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User.WINDOWS2

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Flora

->Temp folder emptied: 151233608 bytes

->Temporary Internet Files folder emptied: 210784286 bytes

->Java cache emptied: 1860287 bytes

->Google Chrome cache emptied: 144842847 bytes

 

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 2791940 bytes

 

User: LocalService.AUTORITE NT

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: NetworkService.AUTORITE NT

->Temp folder emptied: 0 bytes

File delete failed. C:\Documents and Settings\NetworkService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Thibaut

->Temp folder emptied: -1327574327 bytes

->Temporary Internet Files folder emptied: 116432673 bytes

->Java cache emptied: 1952837 bytes

->FireFox cache emptied: 23225426 bytes

->Google Chrome cache emptied: 5960488 bytes

->Apple Safari cache emptied: 198197310 bytes

 

User: Thibaut.XPSP2-09CDFA9CC

->Temp folder emptied: 518804664 bytes

->Temporary Internet Files folder emptied: 307533783 bytes

->Java cache emptied: 34216964 bytes

->FireFox cache emptied: 97248137 bytes

->Google Chrome cache emptied: 150359183 bytes

 

%systemdrive% .tmp files removed: 0 bytes

C:\WINDOWS2\msdownld.tmp folder deleted successfully.

%systemroot% .tmp files removed: 2114013 bytes

%systemroot%\System32 .tmp files removed: 4748288 bytes

Windows Temp folder emptied: 3082819 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 620,41 mb

 

 

OTM by OldTimer - Version 3.0.0.6 log created on 09202009_130219

 

Files moved on Reboot...

 

Registry entries deleted on Reboot...

 

Rapport de MBAM:

 

Malwarebytes' Anti-Malware 1.41

Version de la base de données: 2830

Windows 5.1.2600 Service Pack 2

 

20/09/2009 15:12:54

mbam-log-2009-09-20 (15-12-54).txt

 

Type de recherche: Examen complet (C:\|)

Eléments examinés: 354638

Temps écoulé: 1 hour(s), 51 minute(s), 33 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 1

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 3

Dossier(s) infecté(s): 10

Fichier(s) infecté(s): 67

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Refog Software (Refog.Keylogger) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Refog.Keylogger) -> Bad: (c:\windows2\system32\userinit.exe,C:\WINDOWS2\system32\MPK\MPK.exe) Good: (Userinit.exe) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\2 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\CPDA (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\CPDM (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Images (Refog.Keylogger) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\Documents and Settings\Thibaut\Local Settings\Application Data\gyamk_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thibaut\Local Settings\Application Data\gyamk_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Program Files\Eurobarre\eb.exe (Adware.Eurobarre) -> Quarantined and deleted successfully.

C:\Program Files\Eurobarre\uninstall.exe (Adware.Eurobarre) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A4F3694D-4EC7-4A89-A4EF-7C71CFF49FB2}\RP29\A0005539.exe (Password.Stealer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A4F3694D-4EC7-4A89-A4EF-7C71CFF49FB2}\RP29\A0005537.exe (Password.Stealer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A4F3694D-4EC7-4A89-A4EF-7C71CFF49FB2}\RP34\A0005958.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A4F3694D-4EC7-4A89-A4EF-7C71CFF49FB2}\RP34\A0005963.exe (Password.Stealer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A4F3694D-4EC7-4A89-A4EF-7C71CFF49FB2}\RP34\A0005964.exe (Password.Stealer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A4F3694D-4EC7-4A89-A4EF-7C71CFF49FB2}\RP34\A0005969.exe (Password.Stealer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A4F3694D-4EC7-4A89-A4EF-7C71CFF49FB2}\RP34\A0005971.exe (Password.Stealer) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\1\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\1\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\2\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users.WINDOWS2\Application Data\MPK\2\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\French.lng (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\German.lng (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\icon_1.ico (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Mpk64.dll (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\MPK64.exe (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\MPKView.exe (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Romanian.lng (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Spanish.lng (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\sqlite3.dll (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\unins000.dat (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\unins000.exe (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\alarms.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\clipboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\computer.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\delivery.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\file.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\filters.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\imhelp.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\internet.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\invisible.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\keyboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\logging.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\log_size.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\need_update_net.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\password.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\programs.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\screenshot.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\settings_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\update.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\English\users_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\alarms.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\clipboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\computer.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\delivery.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\filters.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\internet.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\invisible.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\keyboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\logging.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\log_size.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\password.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\programs.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\screenshot.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\settings_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Help\Spanish\users_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Images\english.gif (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Images\german.gif (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Images\russian.gif (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Images\vista_hide.bmp (Refog.Keylogger) -> Quarantined and deleted successfully.

C:\WINDOWS2\system32\MPK\Images\xp_hide.bmp (Refog.Keylogger) -> Quarantined and deleted successfully.