VIrus adware generique.4 ATVX

Fermé
lunk59 Messages postés 29 Date d'inscription samedi 30 octobre 2010 Statut Membre Dernière intervention 22 avril 2012 - Modifié par lunk59 le 30/10/2010 à 14:58
Bonjour,



comme je l'indique dans le messages j'ai un virus qui m'a soudainement attaqué.J'ai AVG free aAnti-virus comme anti virus,J'ai fait une annalyse avec malwarbytes' et j'ai 50 éléments infectés!!!D'aprés AVG la source du virus viendrait de query explorer (choses que je ne connait pas et que j'ignore ou je l'ai attrapé).quelqu'un saurait ou ais-je attrapé ce virus?Sauriez vous m'expliquez comment l'enlevé??
voici le résultat de l'analyse:

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 297602
Temps écoulé: 1 heure(s), 10 minute(s), 47 seconde(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 7
Fichier(s) infecté(s): 27

Processus mémoire infecté(s):
C:\Program Files\PremierOpinion\pmservice.exe (Adware.RelevantKnowledge) -> Unloaded process successfully.
c:\program files\premieropinion\pmropn.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Program Files\PremierOpinion\MSVCP71.DLL (Trojan.Agent) -> Delete on reboot.
C:\Program Files\PremierOpinion\MSVCR71.DLL (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\shopperreports.reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{0d82acd6-a652-4496-a298-2bde705f4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025e484-d4b0-441a-9f0b-69063bd679ce} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258b35c-05b8-4c0e-9525-9bccc70f8f2d} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{a89256ad-ec17-4a83-bef5-4b8bc4f39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286} (Adware.PremierOpinion) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QueryExplorer Service (Adware.QueryExplorer) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\srs_it_e8790571bd765a5233a893 (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_application (Hijacker.Application) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464} (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\chrome (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\defaults (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\defaults\preferences (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\premieropinion (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\QueryExplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion (Adware.PremierOpinion) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\PremierOpinion\pmservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Program Files\QueryExplorer\queryexplorer.exe (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os36F5.tmp\rlls.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os36F5.tmp\rlls64.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os36F5.tmp\rlservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os36F5.tmp\rlvknlg.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os36F5.tmp\rlvknlg64.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os8AE2.tmp\rlls.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os8AE2.tmp\rlls64.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os8AE2.tmp\rlservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os8AE2.tmp\rlvknlg.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Julien\AppData\Local\Temp\~os8AE2.tmp\rlvknlg64.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Windows\Temp\QUE7923.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\chrome.manifest (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\install.rdf (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\chrome\queryexplorer.jar (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\defaults\preferences\prefs.js (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files\premieropinion\MSVCP71.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\premieropinion\MSVCR71.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\premieropinion\pmoci.bin (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\premieropinion\pmropn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion\About PremierOpinion.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion\Privacy Policy and User License Agreement.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion\Support.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion\Uninstall Instructions.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully.
C:\Program Files\dbg.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\SteamUI.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.


Merci d'avance
cordialement Lunk
A voir également: