Probleme virus Avira Antivir Personal...

Question

Bonjour, depuis maintenant 2 semaines mon antivirus, Avira Antivir Personal détecte des "Cheval De troie" environ toute les 5 minutes quand je suis sur Internet et à chaque fois que je lance un logiciel tel que Ccleaner ou iTunes.
Il me marque plusieurs messages différents dont celui la:

- Le fichier "C:\WINDOWS	emp\Ycz.exe" est infecté par le cheval de troie "TR/Spy.68096.59".

Et Avira est incapable de le supprimer, j'ai donc des messages de détection qui s'affiche sur mon écrans sans arrêts.

J'ai lancer une mise à jour, il était à jour. J'ai lancer un scan manuel il ne supprime rien.
J'ai fait un nettoyage par le logiciel "Spybot Search and Destroy" mais le problème persiste.

Merci de votre aide, Diego.



Configuration: Windows XP / Firefox 3.6.18

Destrio5 · Answer

Bonjour,

Laisse tomber Spybot, il te servira à rien.

Utilise ceci :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu peux poster le rapport ici.

diego44 · Answer

Merci, voici le rapport:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Version de la base de données: 6954

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

26/06/2011 18:49:20
mbam-log-2011-06-26 (18-49-20).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 160327
Temps écoulé: 10 minute(s), 43 seconde(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 15

Processus mémoire infecté(s):
c:\WINDOWS	emp\obxp\setup.exe (Spyware.Passwords.XGen) -> 712 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\documents and settings\all users\application data\macromedia\swfupdate\swfupdate.dll (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AMService (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{003541A1-3BC0-1B1C-AAF3-040114001C01} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E} (Trojan.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA} (Trojan.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78} (Trojan.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\PCTutoBHO.PCTBHO.1 (Trojan.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\PCTutoBHO.PCTBHO (Trojan.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{66D8FBA6-D90F-40A9-AC55-84896F79CA69} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_project.bho_object.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_project.bho_object (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{66D8FBA6-D90F-40A9-AC55-84896F79CA69} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\idgbn5xehg (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GHWAUC6NNZ (Trojan.Downloader) -> Value: GHWAUC6NNZ -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3XQZ6EO4AP (Trojan.Downloader) -> Value: 3XQZ6EO4AP -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AMService (Heuristics.Shuriken) -> Value: AMService -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1U0WFOHZPQ (Trojan.Downloader) -> Value: 1U0WFOHZPQ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SwUpdate (Trojan.Agent) -> Value: SwUpdate -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\documents and settings\all users\application data\macromedia\swfupdate (Trojan.Agent) -> Delete on reboot.

Fichier(s) infecté(s):
c:\WINDOWS	emp\obxp\setup.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\WINDOWS	emp\Ycx.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS	emp\ipsu\setup.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\WINDOWS	emp\Ycv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\macromedia\swfupdate\swfupdate.dll (Trojan.Agent) -> Delete on reboot.
c:\program files\PCTuto\pctutobho.dll (Trojan.Eorezo) -> Quarantined and deleted successfully.
c:\program files\Object\bho_project.dll (Trojan.BHO) -> Quarantined and deleted successfully.
c:\WINDOWS	emp\jar_cache2824547211898802872.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\BAPTISTE\application data\Adobe\plugs\kb12890812.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\macromedia\swfupdate\Ui.dtd (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\macromedia\swfupdate\UTemp.dtd (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\macromedia\swfupdate\Local.dtd (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\macromedia\swfupdate\Flags.dtd (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\macromedia\swfupdate\H64DATA.dtd (Trojan.Agent) -> Quarantined and deleted successfully.

Destrio5 · Answer

C'est mieux.

--> Utilise l'option "Scanner" d'Ad-Remover et poste le rapport :
http://www.teamxscript.org/adremoverTelechargement.html

diego44 · Answer

Bonjour, voici le rapport :

Ligne trouvée: user_pref("vshare.install.laststatreq", "1309046400000"); 
Ligne trouvée: user_pref("vshare.install.newtab", false); 
Ligne trouvée: user_pref("vshare.install.overlayVersion", 1); 
-- Fichier Fermé --
 


Valeur trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Run|PCTuto


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [3.6.18 (fr)] ****

HKLM_Extensions|{EB132DB0-A4CA-11DF-9732-0E29E0D72085} - C:\Program Files\Object\facetheme
HKCU_Extensions|{EB132DB0-A4CA-11DF-9732-0E29E0D72085} - C:\Program Files\Object\facetheme

-- C:\Documents and Settings\BAPTISTE\Application Data\Mozilla\FireFox\Profiles\d017mpr7.default --
Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} (DVDVideoSoft Menu)
Extensions\vshare@toolbar (vShare)
Prefs.js - browser.download.lastDir, C:\Documents and Settings\BAPTISTE\Mes documents\Mes images
Prefs.js - browser.startup.homepage, hxxp://www.google.fr/
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.18

========================================

**** Internet Explorer Version [6.0.2900.2180] ****

HKCU_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Start Page - hxxp://www.google.fr/
HKLM_Main|Default_Page_URL - hxxp://global.acer.com
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKCU_Toolbar\ShellBrowser|{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} (x)
HKCU_Toolbar\WebBrowser|{C55BBCD6-41AD-48AD-9953-3609C48EACC7} (x)
HKLM_ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2} - C:\Program Files\Orbitdownloader\orbitdm.exe (x)
HKLM_Extensions\{90EAE591-7E7E-434a-8E28-ECFD00071806} - "PokerStars.fr" (C:\Program Files\PokerStars.FR\main.ico)
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "AcroIEHlprObj Class" (c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll)
BHO\{C22CB03E-96CD-3261-D0E3-BD8DE0760D2D} - "?" (c:\windows\system32\xqesdjcg.dll) (x)

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 1 Fichier(s)

C:\Ad-Report-SCAN[1].txt - 28/06/2011 00:07:48 (1709 Octet(s)) 

Fin à: 00:08:15, 28/06/2011 
 
============== E.O.F ==============

Destrio5 · Answer

Il manque le début du rapport.

diego44 · Answer

Quand je veux poster le rapport complet il m'ai dit : Titre du message non renseigné

Destrio5 · Answer

En faisant Répondre au sujet ou Ajouter un commentaire ?

diego44 · Answer

En faisant Répondre au sujet.

Destrio5 · Answer

Essaie Ajouter un commentaire.

diego44 · Answer

Même probleme ....

Destrio5 · Answer

Tu peux l'héberger sur le site suivant et poster le rapport :
http://pjjoint.malekal.com/

diego44 · Answer

Merci voici le rapport ; http://pjjoint.malekal.com/files.php?read=o15g5h6w9t13r5j8m5b6

diego44 · Answer

Voici le rapport ; http://pjjoint.malekal.com/files.php?read=o15g5h6w9t13r5j8m5b6

Probleme virus Avira Antivir Personal...

13 réponses

Discussions similaires

Newsletters