mon pc rame.....

[nikigabal]

Salut,

 

Oui mon pc plante toujours....

[Thanos]

salut

 

Désolé pour l'attente!

 

Poste ce rapport stp pour voir si un rootkit n'est pas en activité >>

 

Télécharge GMER Rootkit Scanner du lien suivant :

 

http://www.gmer.net/#files

 

- Clique sur le bouton "Download EXE"

- Sauvegarde-le sur ton Bureau

- Colle et sauvegarde ces instructions dans un fichier texte ou imprime-les, car tu devras fermer le navigateur.

- Ferme les fenêtres de navigateur ouvertes

- Lance le fichier téléchargé (le nom comporte 8 chiffres/lettres aléatoires) par double clic ;

- Si l'outil te lance un warning d'activité de rootkit et te demande de faire un scan ; clique "NO"

- Dans la section de droite de la fenêtre de l'outil, décoche les options suivantes :

• Sections
  
• IAT/EAT
  
• **Assure-toi que "Show All" est décoché**
  

- Clique maintenant sur le bouton "Scan" et patiente (cela peut prendre 10 minutes ou +)

- Lorsque l'analyse sera terminée, clique sur le bouton "Save..." (au bas à droite) ;

- Nomme le fichier"Ark.txt" et sauvegarde-le sur le Bureau ;

- Copie/colle le contenu de ce rapport dans ta réponse.

[nikigabal]

Salut,

 

Je viens de télécharger ce que tu m'as dit mais je ne peux rien faire.

 

Quand je l'execute l'ordi s'éteint et se rallume et ce autant de fois que j'essaie.

 

Y'a moyen de faire autre chose ??

[Thanos]

salut

 

Tente de faire le scan en mode sans échec >>

• Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement.
  
• Tapote par alternance les touches [F8] et [F5] jusqu'à l'affichage du menu des options avancées de Windows.
  
• Sélectionne "Mode sans échec" et appuie sur la touche [Entrée].
  
• Clique sur le bouton Oui à l'apparition du message.
  
• Choisis ton compte usuel, et non Administrateur.
  

Fais le scan puis sauvegarde le rapport. Une fois le pc redémarré en mode normal, poste le rapport.

 

Si tu ne parviens pas à utiliser GMER, tente ceci >>

 

Étape 1: RootRepeal (de AD)

Télécharger RootRepeal via un clic droit sur l'un des liens ci-dessous:

http://ad13.geekstogo.com/RootRepeal.zip

http://rootrepeal.googlepages.com/RootRepeal.zip

http://rootrepeal.psikotick.com/RootRepeal.zip

Enregistrer le fichier sur le Bureau.

Créer un nouveau dossier nommé RootRepeal à la racine du disque système (généralement C:\)

 

Décompresser l'archive téléchargée dans ce nouveau dossier RootRepeal

 

 

Étape 2: Pas de processus de contrôle en temps réel

Désactiver le module résident de l'antivirus et celui de l'antispyware.

Avira Antivir: clic droit sur l'icône dans la barre des tâches (à coté de l'horloge), décocher "Activer Antivir Guard/AntiVir Guard enable"

 

 

 

Étape 3: RootRepeal (de AD)

Dans l'Explorateur, ouvrir le dossier RootRepeal

Faire un double clic sur RootRepeal.exe pour lancer l'outil.

Sous Windows Vista, faire un clic droit sur RootRepeal.exe puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.

 

Cliquer sur l'onglet Report (en bas de la fenêtre) comme ceci:

 

Cliquer sur le bouton Scan

 

Dans la nouvelle fenêtre Select Scan, cocher:

+ Drivers

+ Files

+ Processes

+ SSDT

+ Stealth Objects

+ Hidden Services

+ Shadow SSDT

 

Cliquer sur le bouton OK

Dans la nouvelle fenêtre Select Drives, cocher le lecteur système (généralement C:\)

 

Cliquer sur le bouton OK pour lancer l'analyse

 

Note: Cette analyse prend un certain temps. NE PAS LANCER d'autres programmes tant qu'elle est active.

 

Lorsque l'analyse est terminée, le bouton Save Report sera disponible.

 

Cliquer sur ce bouton Save Report et enregistrer le fichier rapport dans le dossier RootRepeal sous le nom RootRepeal-$$$$$$.txt

 

Ouvrir le menu File, cliquer sur Exit pour fermer le programme.

 

 

Étape 4: Processus de contrôle en temps réel

Important: Réactiver le module résident de l'antivirus et celui de l'antispyware.

 

 

Étape 5: Résultats

Envoyer en réponse:

*- le rapport de RootRepeal (contenu du fichier RootRepeal-$$$$$$.txt)

Ce rapport peut être très long. Bien vérifier qu'il est complet dans le message envoyé. Si nécessaire, le découper en plusieurs messages.

[nikigabal]

Salut,

 

J'ai peur de ne pas arriver a faire ce que tu me conseilles.

 

Tu aurais pas une solution plus "facile" ?

 

Excuse moi mais je veux arrêter le carnage et là je crains un peu.

 

Merci

[Thanos]

salut Tente au moins de faire le scan Gmer en mode sans échec. Il n'y a pas de risque: il s'agit d'un simple scan et aucun élément n'est supprimé de Windows

 

MAM a déjà fait du nettoyage, mais il est possible qu'un élément nous échappe, c'est pourquoi je te demande de fiare ces scans (la présence d'un rootkit pourrait expliquer ces plantages/ralentissements).

[nikigabal]

voici le rapport :

 

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2010/01/30 21:57

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

 

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xED0B0000 Size: 98304 File Visible: No Signed: -

Status: -

 

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF7B12000 Size: 8192 File Visible: No Signed: -

Status: -

 

Name: mc22.tmp

Image Path: C:\DOCUME~1\windows\LOCALS~1\Temp\mc22.tmp

Address: 0xF7C54000 Size: 2560 File Visible: No Signed: -

Status: -

 

Name: PCI_PNP4510

Image Path: \Driver\PCI_PNP4510

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

 

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xED753000 Size: 49152 File Visible: No Signed: -

Status: -

 

Name: spge.sys

Image Path: spge.sys

Address: 0xF73DB000 Size: 1048576 File Visible: No Signed: -

Status: -

 

Name: sptd

Image Path: \Driver\sptd

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

 

Hidden/Locked Files

-------------------

Path: c:\documents and settings\windows\local settings\temp\~df1bd6.tmp

Status: Allocation size mismatch (API: 16384, Raw: 0)

 

Path: c:\documents and settings\windows\local settings\temp\~dfe5fe.tmp

Status: Allocation size mismatch (API: 16384, Raw: 0)

 

Path: c:\documents and settings\windows\local settings\temp\~dfe6c4.tmp

Status: Allocation size mismatch (API: 16384, Raw: 0)

 

Path: c:\documents and settings\windows\local settings\temp\~dfec47.tmp

Status: Allocation size mismatch (API: 16384, Raw: 0)

 

Path: c:\documents and settings\windows\local settings\temp\~dff3db.tmp

Status: Allocation size mismatch (API: 262144, Raw: 16384)

 

Path: c:\documents and settings\windows\local settings\temp\~dfa5e6.tmp

Status: Allocation size mismatch (API: 16384, Raw: 0)

 

Path: c:\documents and settings\windows\local settings\temp\~df2cce.tmp

Status: Allocation size mismatch (API: 262144, Raw: 16384)

 

SSDT

-------------------

#: 041 Function Name: NtCreateKey

Status: Hooked by "<unknown>" at address 0xf7ca6396

 

#: 053 Function Name: NtCreateThread

Status: Hooked by "<unknown>" at address 0xf7ca638c

 

#: 063 Function Name: NtDeleteKey

Status: Hooked by "<unknown>" at address 0xf7ca639b

 

#: 065 Function Name: NtDeleteValueKey

Status: Hooked by "<unknown>" at address 0xf7ca63a5

 

#: 071 Function Name: NtEnumerateKey

Status: Hooked by "spge.sys" at address 0xf73faca2

 

#: 073 Function Name: NtEnumerateValueKey

Status: Hooked by "spge.sys" at address 0xf73fb030

 

#: 098 Function Name: NtLoadKey

Status: Hooked by "<unknown>" at address 0xf7ca63aa

 

#: 119 Function Name: NtOpenKey

Status: Hooked by "spge.sys" at address 0xf73dc0c0

 

#: 122 Function Name: NtOpenProcess

Status: Hooked by "<unknown>" at address 0xf7ca6378

 

#: 128 Function Name: NtOpenThread

Status: Hooked by "<unknown>" at address 0xf7ca637d

 

#: 160 Function Name: NtQueryKey

Status: Hooked by "spge.sys" at address 0xf73fb108

 

#: 177 Function Name: NtQueryValueKey

Status: Hooked by "spge.sys" at address 0xf73faf88

 

#: 193 Function Name: NtReplaceKey

Status: Hooked by "<unknown>" at address 0xf7ca63b4

 

#: 204 Function Name: NtRestoreKey

Status: Hooked by "<unknown>" at address 0xf7ca63af

 

#: 247 Function Name: NtSetValueKey

Status: Hooked by "<unknown>" at address 0xf7ca63a0

 

#: 257 Function Name: NtTerminateProcess

Status: Hooked by "<unknown>" at address 0xf7ca6387

 

Stealth Objects

-------------------

Object: Hidden Module [Name: ShareazaIEHelper.dll]

Process: iexplore.exe (PID: 400) Address: 0x05200000 Size: 397312

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]

Process: System Address: 0x867681f8 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]

Process: System Address: 0x86604500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_CREATE]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_CLOSE]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_READ]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_WRITE]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_POWER]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_SYSTEM_CONTROL]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbstor, IRP_MJ_PNP]

Process: System Address: 0x85e1e500 Size: 121

 

Object: Hidden Code [Driver: usbohci, IRP_MJ_CREATE]

Process: System Address: 0x865fe500 Size: 121

 

Object: Hidden Code [Driver: usbohci, IRP_MJ_CLOSE]

Process: System Address: 0x865fe500 Size: 121

 

Object: Hidden Code [Driver: usbohci, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x865fe500 Size: 121

 

Object: Hidden Code [Driver: usbohci, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x865fe500 Size: 121

 

Object: Hidden Code [Driver: usbohci, IRP_MJ_POWER]

Process: System Address: 0x865fe500 Size: 121

 

Object: Hidden Code [Driver: usbohci, IRP_MJ_SYSTEM_CONTROL]

Process: System Address: 0x865fe500 Size: 121

 

Object: Hidden Code [Driver: usbohci, IRP_MJ_PNP]

Process: System Address: 0x865fe500 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP]

Process: System Address: 0x867d81f8 Size: 121

 

Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE]

Process: System Address: 0x85f541f8 Size: 121

 

Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE]

Process: System Address: 0x85f541f8 Size: 121

 

Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x85f541f8 Size: 121

 

Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x85f541f8 Size: 121

 

Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP]

Process: System Address: 0x85f541f8 Size: 121

 

Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP]

Process: System Address: 0x85f541f8 Size: 121

 

Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]

Process: System Address: 0x86603500 Size: 121

 

Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]

Process: System Address: 0x86603500 Size: 121

 

Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x86603500 Size: 121

 

Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x86603500 Size: 121

 

Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]

Process: System Address: 0x86603500 Size: 121

 

Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]

Process: System Address: 0x86603500 Size: 121

 

Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]

Process: System Address: 0x86603500 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP]

Process: System Address: 0x85f421f8 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_CREATE]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_CLOSE]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_READ]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_QUERY_INFORMATION]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_SET_INFORMATION]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_QUERY_VOLUME_INFORMATION]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_DIRECTORY_CONTROL]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_FILE_SYSTEM_CONTROL]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_SHUTDOWN]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_LOCK_CONTROL]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_CLEANUP]

Process: System Address: 0x85f47500 Size: 121

 

Object: Hidden Code [Driver: , IRP_MJ_PNP]

Process: System Address: 0x85f47500 Size: 121

 

==EOF==

[Thanos]

salut

 

Désolé pour l'attente!

 

Je vais te demander de refaire un scan avec MBAM car l'infection est encore présente.

Relance le scan comme indiqué plus haut, après avoir fait la mise à jour du programme stp.

[nikigabal]

Malwarebytes' Anti-Malware 1.44

Version de la base de données: 3674

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

01/02/2010 22:37:59

mbam-log-2010-02-01 (22-37-48).txt

 

Type de recherche: Examen complet (C:\|)

Eléments examinés: 265646

Temps écoulé: 1 hour(s), 39 minute(s), 28 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 1

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\Program Files\Internet Explorer\minftnet.exe (Adware.Agent) -> No action taken.

[Thanos]

salut

 

nikigabal, tu as oublié de notifier à MalwareBytes de supprimer les infecitons détectées!

Ne recommence pas le scan, tu vas plutôt utiliser ton antivirus afin de nettoyer ce que MBAM a trouvé (ainsi que le reste) >>

 

Mets Antivir à jour et configure le en suivant les indications du Tutoriel vidéo d'angelique

(les réglages sont identiques même si la la version décrite est en anglais).

 

Fais un scan du pc avec Antivir comme ceci >>

 

Double-clique sur son icône près de l'horloge: cela ouvre l'interface principale.

Clique ensuite sur "Contrôler syst." à droite de "Dernier contrôle syst. intégral".

/!\ Cela peut être long.

 

Sauvegarde le rapport en fin de parcours (bouton "Rapport").

 

Si Antivir détecte des fichiers infectés, mets les en quarantaine: choisis "Déplacer en quarantaine" dans la liste des actions.

Tu peux automatiser ce type d'action en cochant la case Appliquer la sélection à toutes les détections.

Cela permet de ne pas rester à la surveiller.

 

Poste le rapport stp.