RESOLU de l'aide pour m'enlever spyfalcon 2.0 svp

[bruce lee]

ok,

a mon avis faudra le supprimer mais avant fais ceci:

 

vas sur ce site:

 

1- http://virusscan.jotti.org/

 

et fait analyser C:\WINDOWS\system32\ ginuerep.dll et communique le rapport

[bogjim]

Jotti's malware scan 2.99-TRANSITION_TO_3.00

 

File to upload & scan:

Service

Service load: 0% 100%

 

File: ginuerep.dll

Status: POSSIBLY INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)

MD5 961d4df9eca304c78e5f73527b70c32c

Packers detected: -

Scanner results

AntiVir Found Trojan/FakeAlert.AA

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found nothing

BitDefender Found nothing

ClamAV Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

Fortinet Found nothing

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found nothing

UNA Found nothing

VBA32 Found nothing

 

Powered by

 

Disclaimer

This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.

 

Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.

 

Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.

 

Virus definitions are updated every hour. There is a 15Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.

 

Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. If you do not want your files to be distributed, please do not send them at all.

 

Sponsored by donations (in random order) from: Stormbyte Technologies LLC, The ClamAV project, James Love, Gideon Pertzov, Malcolm Murray, Nigel Thomas, Wendy Dickerson, Anthony Midmore, "ethereal", Mark Rubins, Steve S., Eric Johansen, Eric Schechter, Paul Bokel, Wilders Security, Wilfried Lilie, Prevx, SonicWALL, Lance Mueller, Ewido networks, and some people who prefer to remain anonymous... many thanks to all!

 

Statistics

Last file scanned at least one scanner reported something about: setup.exe, detected by:

 

Scanner Malware name

AntiVir Trojan/PSW.Hazif.A.1

ArcaVir Trojan.Psw.Hazif.A

Avast Win32:Trojan-gen.

AVG Antivirus PSW.Generic.AGX

BitDefender Trojan.Pws.Hazif.A

ClamAV X

Dr.Web Trojan.PWS.Ymagic

F-Prot Antivirus X

Fortinet W32/Cimag.A-pws

Kaspersky Anti-Virus Trojan-PSW.Win32.Hazif.a

NOD32 probably unknown NewHeur_PE

Norman Virus Control X

UNA Trojan.PSW.Win32.Hazif

VBA32 Trojan-PSW.Win32.Hazif.a

 

 

You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives

We are not affiliated with any third parties that conduct tests using this service.

 

 

 

 

 

Frequently asked questions - Feedback

 

 

 

Page generated by JTPL

 

Copyright © 2004-2005 Jordi Bosveld <jotti@jotti.org>

[bruce lee]

re,

normalement tu as toujours l'affichage des fichiers et dossiers cachés.

 

supprime ce qui est en gras:

 

C:\WINDOWS\system32\ ginuerep.dll

 

redemarre le PC et repost un log hijackthis

[bogjim]

je crois que tu l'as eu !!!!!

 

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 18:59:02, on 03/03/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\SECURI~1\Av_Fw\backweb\8520111\Program\SERVIC~1.EXE

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exe

C:\Program Files\Securitoo\Av_Fw\backweb\8520111\program\fsbwsys.exe

C:\Program Files\Securitoo\Av_Fw\Anti-Virus\FSGK32.EXE

C:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXE

C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fssm32.exe

C:\Program Files\Securitoo\Av_Fw\backweb\8520111\Program\fspex.exe

C:\Program Files\Securitoo\Av_Fw\Common\FSMB32.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Securitoo\Av_Fw\Common\FCH32.EXE

C:\Program Files\Securitoo\Av_Fw\Common\FAMEH32.EXE

C:\Program Files\Securitoo\Av_Fw\FWES\Program\fsdfwd.exe

C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsav32.exe

C:\Program Files\Securitoo\Av_Fw\FSGUI\fsguiexe.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Mr Lefevre\Bureau\HijackThis.exe

 

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\Av_Fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\Av_Fw\FSGUI\FSSW.EXE" /reboot

O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\Av_Fw\FSGUI\ispnews.exe"

O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\fsaswreg.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://jeuxvideo.wanadoo.fr/components/Metaboli.ocx

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Securitoo Antivirus Firewall (BackWeb Plug-in - 8520111) - Unknown owner - C:\PROGRA~1\SECURI~1\Av_Fw\backweb\8520111\Program\SERVIC~1.EXE

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exe

O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\Av_Fw\backweb\8520111\program\fsbwsys.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[bruce lee]

oui il est bel et bien parti

 

je crois que tu l'as eu !!!!!

 

non ON l'a eu

Modifié le 3 mars 2006 par bruce lee

[bogjim]

un grand merci a toi , tu es trop fort !!!!!!!

[bruce lee]

un grand merci a toi , tu es trop fort !!!!!!!

 

merci, mais les personnes qui seraient surtout a remercier sont:

 

S!Ri,

moe31

alltrap34

 

ce sont eux qui ont crée smitfraudfix.

 

@+

si tu n'as pu de probleme pense a cloturer la question en editant ton titre et tu mets devant [résolu]