Tu n´as plus qu´a te taper le nettoyage manuellement :
Instructions ici: ( en anglais désolé)
1-Disable System Restore
2-Restart the computer in Safe mode
3-Reverse the changes made to the registry.
4-Restart the computer in Safe mode
5-Run a full system scan and delete all the files detected as Backdoor.Prorat.
When Backdoor.Prorat is executed, it performs the following actions:
Copies itself to the %System% or %Windir% folder. The following file names have been seen, however, it is possible that different variants use different file names:
%System%\Main.exe
%System%\Loader.exe
%System%\Msmsg.exe
%System%\Winserv.dll
%System%\Fservice.exe
%System%\Sservice.exe
%Windir%\Winlogon.exe
Notes:
%Windir% is a variable. The Backdoor.Prorat locates the Windows installation folder ( by default, this is C:\Windows or C:\Winnt) and copies itself to that location.
%System% is a variable. The Backdoor.Prorat locates the System folder and copies itself to that location. By default, this is C:\Windows\System ( Windows 95/98/Me), C:\Winnt\System32 ( Windows NT/2000), or C:\Windows\System32 ( Windows XP).
Creates . dll files in the %System% folder. The following file names have been seen, however, it is possible that different variants use different file names:
%System%\wininv.dll
%System%\winkey.dll
Adds a value at one or more of the following locations in the Windows registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\
Policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre
ntVersion\Run
The following values have been seen added:
" MSNMESENGER"="%System%\Main.exe"
" DirectX for Microsoft Windows"="%System%\Fservice.exe"
" DirectX for Microsoft Windows"="%System%\Sservice.exe"
" StubPath"="C:\Windows\system\Sservice.exe"
Modifies the value data of:
Shell
in the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
from:
" explorer.exe"
to:
" explorer.exe %System%\Fservice.exe"
so that the backdoor runs when you start Windows NT/2000/XP.
Voila.
