christophe
bibounet
  
Age : 16
Inscrit le : 04 Juil 2008
Messages : 4
Localisation : verviers
 |  Sujet: worm/vb.fi.5 ????  Ven 4 Juil - 22:37 | |
| Bien le bonjour ,
je viens vous posez une ou deux petites questions dont vous pourrez surement me répondre ^^ .
Voila, mon antivirus ( avira antivir personal ) me detecte "worm/vb.fi.5" et même après l'avoir supprimé, il le redétecte encore .
J'aimerai savoir comment le supprimer une bonne fois pour toute ?
comment il se propage ?
ce qu'il cause comme problèmes ?
D'avance je vous remercie , Christophe . |
|
K1ks
Moderateurs (trices)
 
Age : 21
Inscrit le : 12 Déc 2007
Messages : 2421
Localisation : ...
| | Sujet: Re: worm/vb.fi.5 ???? Ven 4 Juil - 22:46 | |
| Salut christophe !!
Fais ceci en désactivant Avira au préalable :
Télécharge FlashDisinfector sur ton bureau:
>>> http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
Connecte tous tes préiphériques amovibles à ton ordinateur : disques durs externes, clés USB, appareils photos, lecteur mp3...
Exécute le FlashDisinfector.exe qui se trouve sur ton bureau
NB : Si tu n'as pas assez de ports pour tout connecter, tu recommenceras autant de fois que tu auras de périphériques à brancher.
Affiche les Fichiers cachés de XP >>> Pour afficher les fichiers cachés de XP
Télécharge ComboFix de sUBs sur ton Bureau et pas ailleurs
# Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
# Double clique sur Combofix.exe et suis les instructions.
| Citation: |
/!\ Laisse le travailler et ne l'interromps surtout pas /!\ |
Quand il aura fini, il va généré un log. Poste le rapport dans ta prochaine réponse avec un nouveau log Hijackthis.
| Citation: | Note :
# Ne pas cliquer dans la fenêtre de combofix durant le passage de l'outils.
# Le rapport se trouve également ici : C:\Combofix.txt
# N'oublie pas de réactiver tes protections !!!
|
_________________
*******************************************************************
 |
|
christophe
bibounet
Age : 16
Inscrit le : 04 Juil 2008
Messages : 4
Localisation : verviers
| | Sujet: Re: worm/vb.fi.5 ???? Dim 6 Juil - 13:50 | |
| ComboFix 08-07-05.1 - Julien 2008-07-06 12:34:04.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.64 [GMT 2:00]
Endroit: C:\Documents and Settings\Julien\Bureau\ComboFix.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\bernard\Application Data\ShoppingReport
C:\Documents and Settings\bernard\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\bernard\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\bernard\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\bernard\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\bernard\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\bernard\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\bernard\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
C:\Documents and Settings\Christophe\Application Data\ShoppingReport
C:\Documents and Settings\Christophe\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Christophe\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Christophe\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Christophe\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Christophe\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Christophe\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Christophe\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
C:\Documents and Settings\Christophe\Application Data\Starware
C:\Documents and Settings\Christophe\Application Data\Starware\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Christophe\Application Data\Starware\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\Games\GamesOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\Games\GamesOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\Layouts\PreferencesLayout.xml
C:\Documents and Settings\Christophe\Application Data\Starware\Layouts\PreferencesLayout.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Christophe\Application Data\Starware\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\Manager\ManagerOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\Reference\ReferenceOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\Screensavers\ScreensaversOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\Screensavers\ScreensaversOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Christophe\Application Data\Starware\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Christophe\Application Data\Starware\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Jean-Claude\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
C:\Documents and Settings\Julien\Application Data\ShoppingReport
C:\Documents and Settings\Julien\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Julien\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Julien\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Julien\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Julien\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Julien\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Julien\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
C:\Documents and Settings\Michelle\Application Data\ShoppingReport
C:\Documents and Settings\Michelle\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Michelle\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Michelle\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Michelle\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Michelle\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Michelle\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Michelle\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\AlConfig.xml
C:\Program Files\p2pnetworks\alp2plib.log
C:\Program Files\p2pnetworks\alp2plib.log.bak
C:\Program Files\p2pnetworks\install.log
C:\Program Files\p2pnetworks\mpp2pl.exe
C:\Program Files\p2pnetworks\sp2p.cache
C:\Program Files\p2pnetworks\uninst.exe
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Uninst.exe
C:\Recycled\Recycled
C:\Recycled\Recycled\ctfmon.exe
C:\WINDOWS\AutoUpdateWin31.dll |
|
christophe
bibounet
Age : 16
Inscrit le : 04 Juil 2008
Messages : 4
Localisation : verviers
| | Sujet: Re: worm/vb.fi.5 ???? Dim 6 Juil - 13:50 | |
| .
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))))))))
.
2008-06-30 17:17 . 2008-06-30 17:17 d-------- C:\Program Files\EA GAMES
2008-06-11 17:48 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 16:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\NFS Underground
2008-06-22 10:39 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-06-22 10:32 --------- d-----w C:\Documents and Settings\Jean-Claude\Application Data\AdobeUM
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-25 08:26 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\AdobeUM
2008-05-17 13:45 --------- d-----w C:\Program Files\Log In 1
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2006-01-20 22:32 26,958 ----a-w C:\Program Files\MovieLand Terms.html
2005-11-13 18:35 473 ----a-w C:\Program Files\Raccourci vers Starware.lnk
2005-09-26 21:00 21 ----a-w C:\Program Files\AVPersonalAVWIN.INI
2005-01-09 09:26 0 -c-ha-w C:\Documents and Settings\bernard\hpothb07.dat
2004-09-28 18:48 193,888 ----a-w C:\Program Files\installCertificate.exe
2004-09-18 11:03 18,810,320 ----a-w C:\Program Files\AdbeRdr60_fra_full.exe
.
| Code: | <pre>
----a-w 630,784 2006-12-30 07:55:48 C:\Documents and Settings\bernard\Mes documents\Programmes\Kaon\KKE1.4 UPDATE for 1.0 .exe
----a-w 946,176 2006-07-16 21:19:04 C:\Documents and Settings\bernard\Mes documents\Programmes\Kaon\UPDATE Radiac Tools 4.3 UPDATE for 4.0 .exe
</pre> |
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 21:40 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Interbase Server"="C:\Program Files\InterBase Corp\InterBase\bin\ibserver.exe" [2001-05-04 16:02 1369600]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 14:08 172032]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-17 14:19 262401]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38 866816]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 14:03 36975]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 13:41 196608]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-04-13 07:07 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-30 11:33 98304]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 13:22 86016]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [N/A]
"nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-20 00:10 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.i263"= i263_32.drv
"msacm.imc"= imc32.acm
"VIDC.VP31"= vp31vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Bluetooth Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk
backup=C:\WINDOWS\pss\Bluetooth Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SEE Technical 2005.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\SEE Technical 2005.lnk
backup=C:\WINDOWS\pss\SEE Technical 2005.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2005-05-19 15:47 57344 C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-20 01:09 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeRAM XP]
-ra------ 2006-03-23 01:13 1591808 C:\Program Files\ FreeRAM XP Pro\FreeRAM XP Pro.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2006-11-03 16:57 190464 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando]
--a------ 2007-03-13 10:46 3610192 C:\Program Files\Pando Networks\Pando\pando.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-07-21 13:06 20036648 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusKeeper]
C:\Program Files\VirusKeeper 2007 Pro Evaluation\VirusKeeper.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2006-04-03 18:12 777424 C:\Program Files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yodm3D]
C:\Documents and Settings\bernard\Local Settings\Temp\Yodm3D.exe [N/A]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\support.com\\bin\\tgcmd.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Documents and Settings\\Christophe\\Local Settings\\Application Data\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\bernard\\Mes documents\\Bernard\\eMule\\emule.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\MSN Messenger\\msncall.exe"=
"C:\\Program Files\\Festo\\Catalog\\partsolutions\\lic\\x86\\cnslocal.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\P2P'\\LimeWire.exe"=
"C:\\Program Files\\Pando Networks\\Pando\\pando.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21350:TCP"= 21350:TCP:BitComet 21350 TCP
"21350:UDP"= 21350:UDP:BitComet 21350 UDP
R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2008-04-17 14:19]
R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 04:16]
R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 15:37]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2008-04-17 14:19]
R2 AVPCC;AVPCC;C:\Program Files\AntiViral Toolkit Pro\avpcc.exe [2000-12-07 13:42]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [1998-04-13 10:00]
R2 s7oiehsx;SIMATIC IEPG Help Service;C:\Siemens\common\S7IEPG\s7oiehsx.exe [2004-07-07 12:17]
R2 s7osmcax;s7osmcax;C:\WINDOWS\system32\Drivers\s7osmcax.sys [2003-12-03 12:03]
R2 s7otranx;s7otranx;C:\WINDOWS\system32\Drivers\S7otranx.sys [2003-12-03 12:03]
R2 Sim9Sync;SIMATIC NET Synchronization Service;C:\WINDOWS\system32\sim9sync.exe [2002-06-19 14:37]
R2 SNTIE;SIMATIC Industrial Ethernet (ISO);C:\WINDOWS\system32\DRIVERS\sntie.sys [2004-05-28 18:21]
S3 ;;C:\WINDOWS\system32\Drivers\.sys []
S3 F-SECURE AVP;F-SECURE AVP;C:\Program Files\AntiViral Toolkit Pro\FSAVP.SYS [2001-05-16 12:59]
S3 F-SECURE Filter;F-SECURE Filter;C:\Program Files\AntiViral Toolkit Pro\FSFILTER.SYS [2001-02-28 16:49]
S3 F-SECURE Gatekeeper;F-SECURE Gatekeeper;C:\Program Files\AntiViral Toolkit Pro\FSGK.SYS [2001-05-04 15:54]
S3 F-SECURE Recognizer;F-SECURE Recognizer;C:\Program Files\AntiViral Toolkit Pro\FSREC.SYS [2001-02-28 16:48]
S3 RSPSC;RSPSC;C:\WINDOWS\system32\drivers\rspsc.sys [2007-01-21 17:42]
S3 ultradfg;ultradfg;C:\WINDOWS\system32\DRIVERS\ultradfg.sys [2007-10-08 11:54]
S4 SandBox;Outpost Firewall Sandbox Driver;C:\Program Files\Firewall\kernel\Sandbox.SYS []
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-29 23:40:03 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-06 13:14:48
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-06 13:24:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-06 11:24:00
Pre-Run: 571,904,000 octets libres
Post-Run: 3,538,649,088 octets libres
259 --- E O F --- 2008-06-20 20:08:00 |
|
christophe
bibounet
Age : 16
Inscrit le : 04 Juil 2008
Messages : 4
Localisation : verviers
| | Sujet: Re: worm/vb.fi.5 ???? Dim 6 Juil - 13:52 | |
| voila le rapport . Je suppose que c'est reglé . En tout cas je vous remercie beaucoup.
Christophe |
|
K1ks
Moderateurs (trices)
Age : 21
Inscrit le : 12 Déc 2007
Messages : 2421
Localisation : ...
| | Sujet: Re: worm/vb.fi.5 ???? Dim 6 Juil - 14:09 | |
| Non pas encore !!!
Fais Démarrer/Exécuter copie-colle la commande suivante puis OK:
Code:
| Citation: | | "%userprofile%\Bureau\combofix.exe" /u |
Ca désinstallera ComboFix, Supprimera les points de restauration système (qui sont infectés) et remettra les options de sécurité de Windows par défaut.
Supprime ces 2 fichiers :
| Citation: |
~~ C:\Program Files\MovieLand Terms.html
~~ C:\Program Files\Raccourci vers Starware.lnk |
Télécharge Deckard System Scanner
>>> Lien et Tuto ici <<<
# Suis les indications et poste le rapport obtenu dans ton prochain message.
_________________
*******************************************************************
|
|
