Comment supprimer System Check / System Restore
How to get rid of System Check / System Restore
Mise à jour du 23/03/2012:
Ce
Rogue à lancé une nouvelle campagne ces derniers jours.
Ayant mis à jour RogueKiller (interface graphique), il est important de lire cette note:
* En lieu et place des modes 1 et 2, il y a maintenant des boutons "Scan" et "Suppression".
* A la place du mode 6, il faut utiliser le bouton "Raccourci RAZ"
* Il est très important de ne PAS utiliser de nettoyeurs comme CCleaner avec cette infection, au risque de perdre les données stockées par le rogue dans les dossiers temporaires (il s'agit des raccourcis du bureau, du menu démarrer et de la barre de lancement rapide). Dans le cas contraire, le mode "Raccourci RAZ" de RogueKiller ne pourra pas les restaurer.
2012/03/23 Update:
This rogue comes back these days. Due to the update of RogueKiller (GUI), it's important to read carefully this note:
* Instead of the modes 1 and 2, there's now the "Scan" and "Delete" buttons
* Instead of the mode 6, there's now the "Shortcut Fix" button.
* It's very important NOT to use cleaners like CCleaner with this malware, otherwise you could lose all datas stored in the temp folders by the malware (shortcuts from the start menu, desktop and quick launch). In this case, the "Shortcut Fix" mode of RogueKiller will not be able to restore them.
_______________________________________
Mise à jour du 23/11/2011:
Ce
Rogue à lancé une nouvelle campagne ces derniers jours, employant
exactement le même fonctionnel, un nom différent et presque la même
interface. (System Fix)
2011/11/23 Update:
This rogue comes back these days with the same functionnal, different name and nearly the same GUI. (System Fix)
_______________________________________
- Télécharger et lancer RogueKiller en mode 2 (Suppression) -- Download and start RogueKiller with mode 2 (Delete)
- S'il ne peut pas se lancer, renommez le en "winlogon.exe" -- Il you are unable to lauch it, rename it as "winlogon.exe"
- Vous devriez avoir le rapport suivant -- You should obtain the following report
RogueKiller V6.1.7 [03/11/2011] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: tigzy [Droits d'admin]
Mode: Suppression -- Date : 05/11/2011 09:54:15
¤¤¤ Processus malicieux: 3 ¤¤¤
[SUSP PATH] SIyHoyHlXaPT.exe -- C:\Documents and Settings\All Users\Application Data\SIyHoyHlXaPT.exe -> KILLED [TermProc]
[SUSP PATH] 6DSS92c31Apgjk.exe -- C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe -> KILLED [TermProc]
[SUSP PATH] P1kAlMiG2Kb7Fz.exe -- C:\DOCUME~1\tigzy\LOCALS~1\Temp\P1kAlMiG2Kb7Fz.exe -> KILLED [TermProc]
¤¤¤ Entrees de registre: 5 ¤¤¤
[SUSP PATH] HKLM\[...]\Run : SIyHoyHlXaPT.exe (C:\Documents and Settings\All Users\Application Data\SIyHoyHlXaPT.exe) -> DELETED
[HJPOL] HKCU\[...]\System : DisableTaskMgr (1) -> DELETED
[HJPOL] HKLM\[...]\System : DisableTaskMgr (1) -> DELETED
[HJPOL] HKCU\[...]\Explorer : NoDesktop (1) -> DELETED
[WallPP] HKCU\[...]\Desktop : Wallpaper () -> REPLACED (C:\WINDOWS\web\wallpaper\Colline verdoyante.bmp)
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [LOADED] ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 localhost
Termine : << RKreport[1].txt >>
RKreport[1].txt
- Relancer RogueKiller avec le mode 6 pour rétablir les attributs des fichiers masqués par le rogue. Vous devriez avoir le rapport suivant -- Start RogueKiller again with mode 6 to reset attributes on files hidden by the rogue. You should obtain the following report
RogueKiller V6.1.7 [03/11/2011] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: tigzy [Droits d'admin]
Mode: Raccourcis RAZ -- Date : 05/11/2011 09:55:05
¤¤¤ Processus malicieux: 0 ¤¤¤
¤¤¤ Driver: [LOADED] ¤¤¤
Attributs de fichiers restaures:
Bureau: Success 798 / Fail 0
Lancement rapide: Success 4 / Fail 0
Programmes: Success 2409 / Fail 0
Menu demarrer: Success 139 / Fail 0
Dossier utilisateur: Success 305 / Fail 0
Mes documents: Success 48 / Fail 0
Mes favoris: Success 11 / Fail 0
Mes images: Success 0 / Fail 0
Ma musique: Success 0 / Fail 0
Mes videos: Success 0 / Fail 0
Disques locaux: Success 10477 / Fail 0
Sauvegarde: [FOUND] Success 96 / Fail 1
Lecteurs:
[C:] \Device\HarddiskVolume1 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped
¤¤¤ Infection : Fake HDD ¤¤¤
Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Version de la base de données: 8089
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
05/11/2011 10:15:14
mbam-log-2011-11-05 (10-15-13).txt
Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 169251
Temps écoulé: 9 minute(s), 40 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 7
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 9
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\documents and settings\all users\application data\6dss92c31apgjk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\fgniibr2lcq8x8l.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\siyhoyhlxapt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\tigzy\Bureau\rk_quarantine\6dss92c31apgjk.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\tigzy\Bureau\rk_quarantine\siyhoyhlxapt.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\tigzy\local settings\Temp\p5tm1qbi6dss92.exe.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\tigzy\local settings\temporary internet files\Content.IE5\ZDRB2Q2A\fakehdd[2].vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\tigzy\local settings\temporary internet files\Content.IE5\ZDRB2Q2A\systemrestore[1].vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\RECYCLER\s-1-5-21-1123561945-1202660629-682003330-1003\Dc6\fgniibr2lcq8x8l.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
- Le rogue devrait être supprimé -- The rogue must have been deleted
