Antimalware Doctor

[Selene_69]

Bonjour,

 

Depuis hier soir, j'ai antimalware Doctor sur mon ordi, et impossible de le faire partir! J'ai tenté avec Panda et Malwarebytes' Anti-malware mais il est toujours là!

Je vais ré essayer en lançant Malwarebytes en scan complet cette fois (j'avais fait un scan rapide), mais je ne pense pas que ça va marcher, donc si quelqu'un savait comment faire pour me débarasser de ce truc, ça serait sympa parce que je commence à désespérer >_>

Merci,

 

Selene

[pear]

Bonjour,

 

Téléchargez les logiciels suivants pour les lancer l'un après l'autre.

Vous en posterez tous les rapports ensuite, en fin de procédures

Télécharger TDSSKILLER

- Télécharger le .zip sur le Bureau.

- Extraire son contenu (clic droit >> "Extraire tout...") et valider ;

- Un dossier tdsskiller sera créé sur le Bureau.

Cliquer surStart scan pour lancer l'analyse.

Lorsque l'outil a terminé son travail d'inspection,

 

si des nuisibles ("Malicious objects") ont été trouvés,

 

vérifier que l'option est sélectionnée,

 

puis cliquer sur le bouton ,

 

puis sur le bouton

 

Envoyer en réponse:

*- le rapport de TDSSKiller (contenu du fichier SystemDrive\TDSSKiller.Version_Date_Heure_log.txt)

[systemDrive représente la partition sur laquelle est installé le système, généralement C:]

 

Télécharger Rkill de Grinler sur le bureau,

double clic pour le lancer.

Sous Vista, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur"

Une fenêtre (très rapide) indiquera que tout s'est bien déroulé.

Pour Vista, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.

il y aura 'un rapport là: %SystemDrive%\rkill.log

donnant la liste de tous les processus arrêtés.

 

Désinstallez Mbam, s'il est installé

Téléchargez MBAM

 

Branchez tous les supports amovibles avant de faire ce scan (clé usb/disque dur externe etc)

Vous devez désactiver vos protections et ne savez pas comment faire ->Sur PCA,En Français

* Double cliquez sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation.

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet)

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

Vérifiez que les options Update et Launch soient cochées

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue..

* Dans l'onglet "mise à jour", cliquez sur le bouton Recherche de mise à jour:

Si le pare-feu demande l'autorisation à MBAM de se connecter, acceptez.

* Une fois la mise à jour terminée, allez dans l'onglet Recherche.

* Sélectionnez "Exécuter un examen complet"

* Cliquez sur "Rechercher"

* .L' analyse prendra un certain temps, soyez patient !

* A la fin , un message affichera :

L'examen s'est terminé normalement.

 

*Si MBAM n'a rien trouvé, il le dira aussi.

Cliquez sur "Ok" pour poursuivre.

*Fermez les navigateurs.

Cliquez sur Afficher les résultats .

 

*Sélectionnez tout et cliquez sur Supprimer la sélection ,

MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

puis ouvrir le Bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

* Copiez-collez ce rapport dans la prochaine réponse.

[Selene_69]

merci d'avoir répondu si vite ^^

j'ai commencé et voici le fichier text obtenu :

 

2010/08/05 11:17:08.0676 TDSS rootkit removing tool 2.4.1.0 Aug 4 2010 15:06:41

2010/08/05 11:17:08.0676 ================================================================================

2010/08/05 11:17:08.0676 SystemInfo:

2010/08/05 11:17:08.0676

2010/08/05 11:17:08.0677 OS Version: 6.0.6000 ServicePack: 0.0

2010/08/05 11:17:08.0677 Product type: Workstation

2010/08/05 11:17:08.0677 ComputerName: ELSA_PORTABLE

2010/08/05 11:17:08.0679 UserName: Elsa

2010/08/05 11:17:08.0679 Windows directory: C:\Windows

2010/08/05 11:17:08.0679 System windows directory: C:\Windows

2010/08/05 11:17:08.0679 Processor architecture: Intel x86

2010/08/05 11:17:08.0679 Number of processors: 2

2010/08/05 11:17:08.0679 Page size: 0x1000

2010/08/05 11:17:08.0679 Boot type: Normal boot

2010/08/05 11:17:08.0679 ================================================================================

2010/08/05 11:17:09.0974 Initialize success

2010/08/05 11:25:12.0873 ================================================================================

2010/08/05 11:25:12.0873 Scan started

2010/08/05 11:25:12.0873 Mode: Manual;

2010/08/05 11:25:12.0873 ================================================================================

2010/08/05 11:25:13.0656 ACPI (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys

2010/08/05 11:25:13.0873 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

2010/08/05 11:25:14.0046 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

2010/08/05 11:25:14.0095 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

2010/08/05 11:25:14.0132 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

2010/08/05 11:25:14.0290 AFD (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys

2010/08/05 11:25:14.0344 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2010/08/05 11:25:14.0402 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys

2010/08/05 11:25:14.0462 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

2010/08/05 11:25:14.0532 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys

2010/08/05 11:25:14.0578 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

2010/08/05 11:25:14.0629 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

2010/08/05 11:25:14.0722 AmFSM (b57d8f7749da70078c43c756baa7f419) C:\Windows\system32\DRIVERS\amm8660.sys

2010/08/05 11:25:14.0842 AnyDVD (44cd59211eb6da497b48d6b21f0c4820) C:\Windows\system32\Drivers\AnyDVD.sys

2010/08/05 11:25:15.0051 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

2010/08/05 11:25:15.0182 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

2010/08/05 11:25:15.0237 AsyncMac (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys

2010/08/05 11:25:15.0282 atapi (b35cfcef838382ab6490b321c87edf17) C:\Windows\system32\drivers\atapi.sys

2010/08/05 11:25:15.0507 Beep (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys

2010/08/05 11:25:15.0660 bowser (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys

2010/08/05 11:25:15.0706 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2010/08/05 11:25:15.0768 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2010/08/05 11:25:15.0876 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

2010/08/05 11:25:15.0927 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2010/08/05 11:25:15.0982 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2010/08/05 11:25:16.0021 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

2010/08/05 11:25:16.0075 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2010/08/05 11:25:16.0128 cdfs (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys

2010/08/05 11:25:16.0176 cdrom (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys

2010/08/05 11:25:16.0236 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

2010/08/05 11:25:16.0295 CLFS (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys

2010/08/05 11:25:16.0380 CmBatt (ed97ad3df1b9005989eaf149bf06c821) C:\Windows\system32\DRIVERS\CmBatt.sys

2010/08/05 11:25:16.0429 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys

2010/08/05 11:25:16.0504 Compbatt (722936afb75a7f509662b69b5632f48a) C:\Windows\system32\DRIVERS\compbatt.sys

2010/08/05 11:25:16.0541 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

2010/08/05 11:25:16.0600 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

2010/08/05 11:25:16.0696 DfsC (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys

2010/08/05 11:25:16.0793 disk (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys

2010/08/05 11:25:16.0977 drmkaud (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys

2010/08/05 11:25:17.0070 DXGKrnl (334988883de69adb27e2cf9f9715bbdb) C:\Windows\System32\drivers\dxgkrnl.sys

2010/08/05 11:25:17.0151 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

2010/08/05 11:25:17.0220 Ecache (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys

2010/08/05 11:25:17.0362 ElbyCDFL (c61c83501268b0110b5c5db7e63dee0c) C:\Windows\system32\Drivers\ElbyCDFL.sys

2010/08/05 11:25:17.0426 ElbyCDIO (aaa8999a169e39fb8b48ae49cd6ac30a) C:\Windows\system32\Drivers\ElbyCDIO.sys

2010/08/05 11:25:17.0461 ElbyDelay (df9957db3bfe5136aad3c2c101806c98) C:\Windows\system32\Drivers\ElbyDelay.sys

2010/08/05 11:25:17.0509 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

2010/08/05 11:25:17.0625 fastfat (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys

2010/08/05 11:25:17.0680 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

2010/08/05 11:25:17.0772 FETNDIS (b2b2c38e916184ff8523c7439ddd417f) C:\Windows\system32\DRIVERS\fetnd5.sys

2010/08/05 11:25:17.0822 FileInfo (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys

2010/08/05 11:25:17.0855 Filetrace (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys

2010/08/05 11:25:17.0900 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

2010/08/05 11:25:17.0934 FltMgr (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys

2010/08/05 11:25:18.0009 Fs_Rec (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys

2010/08/05 11:25:18.0046 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

2010/08/05 11:25:18.0119 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\Windows\system32\Drivers\GEARAspiWDM.sys

2010/08/05 11:25:18.0203 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

2010/08/05 11:25:18.0252 HDAudBus (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys

2010/08/05 11:25:18.0306 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2010/08/05 11:25:18.0343 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

2010/08/05 11:25:18.0434 HidUsb (3c64042b95e583b366ba4e5d2450235e) C:\Windows\system32\DRIVERS\hidusb.sys

2010/08/05 11:25:18.0519 Hotkey (8b566ea71d5b76157a9cdb78f25a5731) C:\Windows\system32\drivers\Hotkey.sys

2010/08/05 11:25:18.0546 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

2010/08/05 11:25:18.0648 HTTP (ea24fe637d974a8a31bc650f478e3533) C:\Windows\system32\drivers\HTTP.sys

2010/08/05 11:25:18.0738 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

2010/08/05 11:25:18.0840 i8042prt (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys

2010/08/05 11:25:19.0007 ialm (c134e69ce901422d1f2d7ea8d69098fe) C:\Windows\system32\DRIVERS\igdkmd32.sys

2010/08/05 11:25:19.0241 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\Windows\system32\DRIVERS\iaStor.sys

2010/08/05 11:25:19.0320 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

2010/08/05 11:25:19.0454 igfx (c134e69ce901422d1f2d7ea8d69098fe) C:\Windows\system32\DRIVERS\igdkmd32.sys

2010/08/05 11:25:19.0537 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2010/08/05 11:25:19.0739 IntcAzAudAddService (aef2fa29204056b81bc4cbf30260dee1) C:\Windows\system32\drivers\RTKVHDA.sys

2010/08/05 11:25:19.0873 intelide (988981c840084f480ba9e3319cebde1b) C:\Windows\system32\drivers\intelide.sys

2010/08/05 11:25:19.0906 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys

2010/08/05 11:25:19.0972 IpFilterDriver (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2010/08/05 11:25:20.0042 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

2010/08/05 11:25:20.0085 IPNAT (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys

2010/08/05 11:25:20.0155 IRENUM (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys

2010/08/05 11:25:20.0208 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

2010/08/05 11:25:20.0281 iScsiPrt (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys

2010/08/05 11:25:20.0319 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2010/08/05 11:25:20.0383 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2010/08/05 11:25:20.0436 Iviaspi (5dce7eed60bae992bab7f5ff1ce60641) C:\Windows\system32\drivers\iviaspi.sys

2010/08/05 11:25:20.0497 kbdclass (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys

2010/08/05 11:25:20.0557 kbdhid (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys

2010/08/05 11:25:20.0646 KSecDD (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys

2010/08/05 11:25:20.0780 lltdio (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys

2010/08/05 11:25:20.0891 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

2010/08/05 11:25:20.0923 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

2010/08/05 11:25:20.0983 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

2010/08/05 11:25:21.0031 luafv (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys

2010/08/05 11:25:21.0178 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

2010/08/05 11:25:21.0240 Modem (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys

2010/08/05 11:25:21.0317 monitor (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys

2010/08/05 11:25:21.0364 mouclass (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys

2010/08/05 11:25:21.0411 mouhid (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys

2010/08/05 11:25:21.0460 MountMgr (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys

2010/08/05 11:25:21.0503 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

2010/08/05 11:25:21.0542 mpsdrv (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys

2010/08/05 11:25:21.0591 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2010/08/05 11:25:21.0630 MRxDAV (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys

2010/08/05 11:25:21.0691 mrxsmb (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys

2010/08/05 11:25:21.0756 mrxsmb10 (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2010/08/05 11:25:21.0824 mrxsmb20 (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2010/08/05 11:25:21.0883 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys

2010/08/05 11:25:21.0919 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

2010/08/05 11:25:21.0980 Msfs (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys

2010/08/05 11:25:22.0030 msisadrv (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys

2010/08/05 11:25:22.0141 MSKSSRV (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys

2010/08/05 11:25:22.0189 MSPCLOCK (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys

2010/08/05 11:25:22.0221 MSPQM (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys

2010/08/05 11:25:22.0258 MsRPC (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys

2010/08/05 11:25:22.0313 mssmbios (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys

2010/08/05 11:25:22.0356 MSTEE (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys

2010/08/05 11:25:22.0398 Mup (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys

2010/08/05 11:25:22.0488 NativeWifiP (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys

2010/08/05 11:25:22.0614 NDIS (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys

2010/08/05 11:25:22.0685 NdisTapi (658b0fdd57ebe34db6fa1e00141c3640) C:\Windows\system32\DRIVERS\ndistapi.sys

2010/08/05 11:25:22.0721 Ndisuio (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys

2010/08/05 11:25:22.0755 NdisWan (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys

2010/08/05 11:25:22.0786 NDProxy (dbcc3f1e63ac0e00ba368c55c514b468) C:\Windows\system32\drivers\NDProxy.sys

2010/08/05 11:25:22.0884 NetBIOS (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys

2010/08/05 11:25:22.0980 netbt (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys

2010/08/05 11:25:23.0117 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2010/08/05 11:25:23.0178 Npfs (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys

2010/08/05 11:25:23.0254 nsiproxy (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys

2010/08/05 11:25:23.0374 Ntfs (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys

2010/08/05 11:25:23.0454 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2010/08/05 11:25:23.0493 Null (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys

2010/08/05 11:25:23.0548 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys

2010/08/05 11:25:23.0592 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys

2010/08/05 11:25:23.0652 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

2010/08/05 11:25:23.0845 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\DRIVERS\ohci1394.sys

2010/08/05 11:25:24.0064 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\DRIVERS\parport.sys

2010/08/05 11:25:24.0103 partmgr (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys

2010/08/05 11:25:24.0152 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\DRIVERS\parvdm.sys

2010/08/05 11:25:24.0245 pavboot (210a628a0d7b3f45257850efbff27538) C:\Windows\system32\Drivers\pavboot.sys

2010/08/05 11:25:24.0342 PavProc (05716f59417c3e058c6e36cf8dec5676) C:\Windows\system32\DRIVERS\PavProc.sys

2010/08/05 11:25:24.0478 PCAMp50 (1bf91f352d746ad7469fa71783b5fae8) C:\Windows\system32\Drivers\PCAMp50.sys

2010/08/05 11:25:24.0517 PCASp50 (1961590aa191b6b7dcf18a6a693af7b8) C:\Windows\system32\Drivers\PCASp50.sys

2010/08/05 11:25:24.0573 pci (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys

2010/08/05 11:25:24.0619 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys

2010/08/05 11:25:24.0675 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

2010/08/05 11:25:24.0739 PCTCore (807ff1dd6e1bdf8e7d2062fca0daecaf) C:\Windows\system32\drivers\PCTCore.sys

2010/08/05 11:25:24.0829 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2010/08/05 11:25:25.0111 PptpMiniport (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys

2010/08/05 11:25:25.0148 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

2010/08/05 11:25:25.0264 PSched (c35020e28a9f3537cd9eb435a932a090) C:\Windows\system32\DRIVERS\pacer.sys

2010/08/05 11:25:25.0391 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

2010/08/05 11:25:25.0479 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2010/08/05 11:25:25.0561 QWAVEdrv (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys

2010/08/05 11:25:25.0701 R300 (e642b131fb74caf4bb8a014f31113142) C:\Windows\system32\DRIVERS\atikmdag.sys

2010/08/05 11:25:25.0871 RasAcd (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys

2010/08/05 11:25:25.0939 Rasl2tp (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys

2010/08/05 11:25:25.0981 RasPppoe (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys

2010/08/05 11:25:26.0027 rdbss (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys

2010/08/05 11:25:26.0076 RDPCDD (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys

2010/08/05 11:25:26.0143 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

2010/08/05 11:25:26.0221 RDPENCDD (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys

2010/08/05 11:25:26.0305 RDPWD (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys

2010/08/05 11:25:26.0431 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys

2010/08/05 11:25:26.0467 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys

2010/08/05 11:25:26.0492 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys

2010/08/05 11:25:26.0558 rspndr (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys

2010/08/05 11:25:26.0619 RTL8169 (b8b159fa669c6386a458fcd468ebb1e6) C:\Windows\system32\DRIVERS\Rtlh86.sys

2010/08/05 11:25:26.0676 RTL8187B (0f2d736066656dee1c791087e0751e99) C:\Windows\system32\DRIVERS\RTL8187B.sys

2010/08/05 11:25:26.0818 s0017bus (594ff5620661d1386475406e78cb6f2f) C:\Windows\system32\DRIVERS\s0017bus.sys

2010/08/05 11:25:26.0914 s0017mdfl (7258f550419d543bc5c8e80c578a5d54) C:\Windows\system32\DRIVERS\s0017mdfl.sys

2010/08/05 11:25:26.0989 s0017mdm (1de4f6607feb17a15dbd4f1b139e6d2f) C:\Windows\system32\DRIVERS\s0017mdm.sys

2010/08/05 11:25:27.0044 s0017mgmt (9814e6bacc06d2526cd52981c7eeedf0) C:\Windows\system32\DRIVERS\s0017mgmt.sys

2010/08/05 11:25:27.0088 s0017obex (f87c3422e84b2fb1b43e0a26247ad5a5) C:\Windows\system32\DRIVERS\s0017obex.sys

2010/08/05 11:25:27.0141 s0017unic (df5e7360a0afa5956bf75da683d0679f) C:\Windows\system32\DRIVERS\s0017unic.sys

2010/08/05 11:25:27.0273 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2010/08/05 11:25:27.0491 sdbus (7b3973cc28b8aa3e9e2e5d53e720e2c9) C:\Windows\system32\DRIVERS\sdbus.sys

2010/08/05 11:25:27.0562 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2010/08/05 11:25:27.0682 seehcri (e5b56569a9f79b70314fede6c953641e) C:\Windows\system32\DRIVERS\seehcri.sys

2010/08/05 11:25:27.0752 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys

2010/08/05 11:25:27.0792 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys

2010/08/05 11:25:27.0876 sermouse (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys

2010/08/05 11:25:28.0039 sffdisk (51cf56aa8bcc241f134b420b8f850406) C:\Windows\system32\DRIVERS\sffdisk.sys

2010/08/05 11:25:28.0075 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

2010/08/05 11:25:28.0167 sffp_sd (8b08cab1267b2c377883fc9e56981f90) C:\Windows\system32\DRIVERS\sffp_sd.sys

2010/08/05 11:25:28.0215 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

2010/08/05 11:25:28.0334 ShldDrv (25d7d8fd7e150cfbda160ebb38171334) C:\Windows\system32\DRIVERS\ShlDrv51.sys

2010/08/05 11:25:28.0380 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

2010/08/05 11:25:28.0437 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

2010/08/05 11:25:28.0515 Smb (03e82089fd6a1b18bf0309351972841a) C:\Windows\system32\DRIVERS\smb.sys

2010/08/05 11:25:28.0517 Suspicious file (Forged): C:\Windows\system32\DRIVERS\smb.sys. Real md5: 03e82089fd6a1b18bf0309351972841a, Fake md5: 2598979c777c9d8358e4925ec00d78a1

2010/08/05 11:25:28.0519 Smb - detected Rootkit.Win32.TDSS.tdl3 (0)

2010/08/05 11:25:28.0599 smserial (d9bfd2298f5cf116d8eaae3b02dcee2e) C:\Windows\system32\DRIVERS\smserial.sys

2010/08/05 11:25:28.0746 snapman (e78c98378a071ce4d48a7c514fa98fa1) C:\Windows\system32\DRIVERS\snapman.sys

2010/08/05 11:25:28.0914 SNP2UVC (53d1e2ecbf26b313ffdd2b8ba3d2f66e) C:\Windows\system32\DRIVERS\snp2uvc.sys

2010/08/05 11:25:29.0087 spldr (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys

2010/08/05 11:25:29.0173 srv (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys

2010/08/05 11:25:29.0298 srv2 (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys

2010/08/05 11:25:29.0380 srvnet (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys

2010/08/05 11:25:29.0450 swenum (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys

2010/08/05 11:25:29.0502 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2010/08/05 11:25:29.0544 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2010/08/05 11:25:29.0591 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2010/08/05 11:25:29.0670 SynTP (3196c5df63d5e86fc0041ae0c816b80f) C:\Windows\system32\DRIVERS\SynTP.sys

2010/08/05 11:25:29.0852 Tcpip (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\drivers\tcpip.sys

2010/08/05 11:25:29.0978 Tcpip6 (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\DRIVERS\tcpip.sys

2010/08/05 11:25:30.0068 tcpipreg (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys

2010/08/05 11:25:30.0119 TDPIPE (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys

2010/08/05 11:25:30.0152 TDTCP (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys

2010/08/05 11:25:30.0225 tdx (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys

2010/08/05 11:25:30.0294 TermDD (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys

2010/08/05 11:25:30.0426 tifsfilter (d352fff2a623b916c08ceacbfc8b5c32) C:\Windows\system32\DRIVERS\tifsfilt.sys

2010/08/05 11:25:30.0474 timounter (64694b2a5c772e1c61feac300ed90ca6) C:\Windows\system32\DRIVERS\timntr.sys

2010/08/05 11:25:30.0598 tssecsrv (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys

2010/08/05 11:25:30.0737 tunmp (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys

2010/08/05 11:25:30.0781 tunnel (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys

2010/08/05 11:25:30.0855 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\DRIVERS\uagp35.sys

2010/08/05 11:25:30.0912 udfs (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys

2010/08/05 11:25:31.0033 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

2010/08/05 11:25:31.0079 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

2010/08/05 11:25:31.0144 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2010/08/05 11:25:31.0185 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2010/08/05 11:25:31.0263 umbus (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys

2010/08/05 11:25:31.0418 USBAAPL (7c9f1503245402b01c79bdfa8731cb2a) C:\Windows\system32\Drivers\usbaapl.sys

2010/08/05 11:25:31.0478 usbccgp (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\DRIVERS\usbccgp.sys

2010/08/05 11:25:31.0542 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2010/08/05 11:25:31.0630 usbehci (fb50f987304f907a0103b14a5f2f2344) C:\Windows\system32\DRIVERS\usbehci.sys

2010/08/05 11:25:31.0696 usbhub (16675ab7e199635086ab0556137371f5) C:\Windows\system32\DRIVERS\usbhub.sys

2010/08/05 11:25:31.0810 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

2010/08/05 11:25:31.0880 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys

2010/08/05 11:25:31.0945 USBSTOR (7da1833f2b2500c755ab6c81c5abfc88) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2010/08/05 11:25:31.0991 usbuhci (165bb1f0801118dc86aa3fc87d3d101c) C:\Windows\system32\DRIVERS\usbuhci.sys

2010/08/05 11:25:32.0070 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys

2010/08/05 11:25:32.0461 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

2010/08/05 11:25:32.0519 VgaSave (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys

2010/08/05 11:25:32.0563 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

2010/08/05 11:25:32.0606 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

2010/08/05 11:25:32.0668 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys

2010/08/05 11:25:32.0727 volmgr (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys

2010/08/05 11:25:32.0847 volmgrx (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys

2010/08/05 11:25:32.0916 volsnap (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys

2010/08/05 11:25:32.0960 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

2010/08/05 11:25:33.0089 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2010/08/05 11:25:33.0154 Wanarp (c08d40e3f2bbe617782e7f9de5f5ec20) C:\Windows\system32\DRIVERS\wanarp.sys

2010/08/05 11:25:33.0171 Wanarpv6 (c08d40e3f2bbe617782e7f9de5f5ec20) C:\Windows\system32\DRIVERS\wanarp.sys

2010/08/05 11:25:33.0249 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

2010/08/05 11:25:33.0342 Wdf01000 (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys

2010/08/05 11:25:33.0692 WmiAcpi (17eac0d023a65fa9b02114cc2baacad5) C:\Windows\system32\DRIVERS\wmiacpi.sys

2010/08/05 11:25:33.0859 WpdUsb (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys

2010/08/05 11:25:33.0901 ws2ifsl (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys

2010/08/05 11:25:34.0020 WUDFRd (a2aafcc8a204736296d937c7c545b53f) C:\Windows\system32\DRIVERS\WUDFRd.sys

2010/08/05 11:25:34.0309 \HardDisk0\MBR - detected Backdoor.Win32.Sinowal.knf (0)

2010/08/05 11:25:34.0325 ================================================================================

2010/08/05 11:25:34.0325 Scan finished

2010/08/05 11:25:34.0325 ================================================================================

2010/08/05 11:25:34.0359 Detected object count: 2

2010/08/05 11:25:49.0101 Smb (03e82089fd6a1b18bf0309351972841a) C:\Windows\system32\DRIVERS\smb.sys

2010/08/05 11:25:49.0102 Suspicious file (Forged): C:\Windows\system32\DRIVERS\smb.sys. Real md5: 03e82089fd6a1b18bf0309351972841a, Fake md5: 2598979c777c9d8358e4925ec00d78a1

2010/08/05 11:25:54.0595 Backup copy found, using it..

2010/08/05 11:25:54.0743 C:\Windows\system32\DRIVERS\smb.sys - will be cured after reboot

2010/08/05 11:25:54.0743 Rootkit.Win32.TDSS.tdl3(Smb) - User select action: Cure

2010/08/05 11:26:09.0135 \HardDisk0\MBR - processing error

2010/08/05 11:26:10.0136 Backdoor.Win32.Sinowal.knf(\HardDisk0\MBR) - User select action: Cure

2010/08/05 11:26:22.0061 Deinitialize success

 

 

EDIT fichier log rkill

This log file is located at C:\rkill.log.

Please post this only if requested to by the person helping you.

Otherwise you can close this log when you wish.

Ran as Elsa on 05/08/2010 at 11:39:52.

 

 

Processes terminated by Rkill or while it was running:

 

 

C:\Windows\svc.exe

C:\Users\Elsa\AppData\Local\Temp\19aqp.exe

C:\Users\Elsa\AppData\Roaming\C4AF7E9213EB8FD0FD88775BD2E73797\newreleaseversion70700.exe

C:\Windows\system32\updata.exe

C:\Users\Elsa\Desktop\rkill.exe

 

 

Rkill completed on 05/08/2010 at 11:40:23.

 

EDIT : rapport MBAM

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Version de la base de données: 4391

 

Windows 6.0.6000

Internet Explorer 7.0.6000.17037

 

05/08/2010 14:35:26

mbam-log-2010-08-05 (14-35-26).txt

 

Type d'examen: Examen complet (C:\|D:\|)

Elément(s) analysé(s): 346740

Temps écoulé: 2 heure(s), 33 minute(s), 6 seconde(s)

 

Processus mémoire infecté(s): 2

Module(s) mémoire infecté(s): 1

Clé(s) du Registre infectée(s): 3

Valeur(s) du Registre infectée(s): 6

Elément(s) de données du Registre infecté(s): 1

Dossier(s) infecté(s): 2

Fichier(s) infecté(s): 60

 

Processus mémoire infecté(s):

C:\Windows\System32\szetyj67vx.exe (Trojan.LVBP) -> Unloaded process successfully.

C:\Windows\svc3.exe (Trojan.Sisproc.Gen) -> Unloaded process successfully.

 

Module(s) mémoire infecté(s):

C:\Users\Elsa\AppData\Local\Temp\msvjidkm.dll (Trojan.PWS) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\SolutionAV (Rogue.AntivirSolutionPro) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xyqzbz (Trojan.PWS) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\szetyj67vx (Trojan.LVBP) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netlog3 (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newreleaseversion70700.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\szetyj67v (Backdoor.Refpron) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jgyo0w (Trojan.Downloader) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Sisproc.Gen) -> Data: c:\windows\svc.exe -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

C:\Users\Elsa\AppData\Roaming\ARManager (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages (Rogue.ARManager) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\Users\Elsa\AppData\Local\Temp\msvjidkm.dll (Trojan.PWS) -> Delete on reboot.

C:\Windows\System32\szetyj67vx.exe (Trojan.LVBP) -> Quarantined and deleted successfully.

C:\Windows\svc3.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\C4AF7E9213EB8FD0FD88775BD2E73797\newreleaseversion70700.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Windows\System32\szetyj67v.exe (Backdoor.Refpron) -> Quarantined and deleted successfully.

C:\Program Elsa\Cryptload_1.1.8\cl1.1.8\ocr\netload.in\asmCaptcha\test.exe (Malware.Packer) -> Quarantined and deleted successfully.

C:\Program Elsa\Cryptload_1.1.8\cl1.1.8\router\FRITZ!Box\nc.exe (PUP.KeyLogger) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPLD4H04\aaidkfmhfa[1].htm (Adware.BHO) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\mxrcawseno.exe (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\n0yetaebj.exe (Trojan.LVBP) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\v75l0hljr.exe (Trojan.LVBP) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\1gpzmyor.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\rdaa9c2x2.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\cgdlnycek.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\2ir1o0qt.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\6A56.tmp (Rootkit.Dropper) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\71D5.tmp (Rootkit.Dropper) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\9c2x2n5v.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\ukdoi.exe (Adware.BHO) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\clviuln5x.exe (Trojan.LVBP) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\wsl7decg.exe (Trojan.LVBP) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\xcrwmnaeos.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\zr5ys19xw.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\_BEE5.tmp (Trojan.Lukicsel) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\Itf.dat (Trojan.Fraudpack) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\63356,0419082642.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\avp32.dat (Trojan.Clicker) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\axsnmcewro.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\bot.dat (Worm.Joleee) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\caxswonemr.dat (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\cmewxsnrao.dat (Adware.AdRotator) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\g37.dat (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\geurge.dat (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\gmfrxpgv.dat (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\gu4r0r9m.dat (Trojan.Ertfor) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\Iti.dat (Trojan.Fraudpack) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\janfw.dat (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\mdm.dat (Trojan.Clicker) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\Microsoft\Windows\Templates\n.dat (Trojan.Harnig) -> Quarantined and deleted successfully.

C:\Windows\svc.exe (Trojan.Sisproc.Gen) -> Quarantined and deleted successfully.

C:\Windows\System32\updata.exe (Trojan.Refpron) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\files (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\iplog (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\ispinfo (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\shot.jpeg (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\wallpaper.jpg (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\Czech.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\Danish.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\Dutch.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\English.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\French.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\German.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\Italian.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\Portuguese.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\Slovak.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\Spanish.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Roaming\ARManager\languages\template.lng (Rogue.ARManager) -> Quarantined and deleted successfully.

C:\Users\Elsa\AppData\Local\Temp\19aqp.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Windows\System32\comsats.sys (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\service.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

 

L'ordi a redémarré et j'ai pas revu Antimalware au démarrage, ni dans 'programmes et fonctionnalités', je pense que j'en suis débarrassée !

Merci beaucoup =D

 

Selene

Modifié le 5 août 2010 par Selene_69

[Selene_69]

C'est encore moi (désolée, je suis chiante t_t), j'ai des problèmes, et je ne sais pas si ça a un rapport avec les logiciels que j'ai utilisés ce matin ou pas :S

 

hier soir, en tapant dans la barre de recherche google en haut à droite (search engine), j'avais ça : Imageshack - sanstitre2my.jpg

et maintenant j'ai ça : Imageshack - sanstitre1ql.jpg

(et j'obtiens le premier en passant par google.com mais vu que j'utilise énormément la barre de recherche, ça m'embette un peu ^^°)

et je ne sais pas comment faire pour remettre comme avant.

 

(j'ai aussi 2 dossier dans C:/ qui s'appelle 17130 et 17205, avec 17130.exe et 17205.exe à l'intérieur mais qui pèsent 0 octects, et je voulais savoir si je pouvais les supprimer. (je demande, sait-on jamais, pas vraiment envie que ça me détraque tout maintenant :S))

[pear]

(j'ai aussi 2 dossier dans C:/ qui s'appelle 17130 et 17205, avec 17130.exe et 17205.exe à l'intérieur mais qui pèsent 0 octects, et je voulais savoir si je pouvais les supprimer. (je demande, sait-on jamais, pas vraiment envie que ça me détraque tout maintenant :S))

 

Supprimez.

 

Votre problème Google,

je ne sais pas.Désolé.

[Apollo]

Bonjour,

 

Si vous me permettez pear:

 

Selene69, est-ce que ceci pourrait arranger ton problème de Google? J'avoue que je ne sais pas si j'ai bien saisi le souci...

 

Rends-toi ici: http://www.ieaddons.com/fr/searchproviders/

 

En bas de page, clique sur "créez votre propre moteur de recherche".

 

Quand tu te retrouves sur cette page: http://ieaddons.com/fr/createsearch.aspx

 

 

Ouvre un nouvel onglet et tape le moteur de recherche que tu souhaites utiliser, par exemple: Google.fr

 

Dans la barre de recherche, tape le mot TEST (en majuscules) puis clique sur rechercher.

 

Dans la barre de navigation au-dessus, copie le lien et colle-le à la place URL de la page que j'ai indiquée en capture d'écran.

 

Donne-lui le nom de Google puis clique sur Installer le moteur de recherche.

 

Cela devrait solutionner ton souci, car j'ai connu la même mésaventure

 

@++

 

EDIT: Désolé mais cela ne concerne pas Firefox... enfin si cela peut servir à quelqu'un..

Modifié le 5 août 2010 par Apollo