J'ai un probléme dee spyware je ne sias plus

Réponse 21 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

et voila pour combofix

"kirchener" - 2007-07-21 16:09:44 - ComboFix 07-07-14.6 - Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 )))))))))))))))))))))))))))))))

2007-07-21 14:12 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-21 13:49 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-07-19 14:08 138,368 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2007-07-19 13:23 <REP> d-------- C:\Program Files\Spyware Terminator
2007-07-19 13:23 <REP> d-------- C:\DOCUME~1\KIRCHE~1\APPLIC~1\Spyware Terminator
2007-07-19 13:23 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
2007-07-18 20:22 <REP> d-------- C:\Program Files\Micro Application
2007-07-18 16:30 <REP> d-------- C:\Program Files\Lavasoft
2007-07-18 16:30 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-18 10:15 <REP> d-------- C:\Program Files\ThinkNet
2007-07-14 18:38 <REP> d-------- C:\VundoFix Backups
2007-07-12 14:26 <REP> d-------- C:\DOCUME~1\KIRCHE~1\APPLIC~1\ScanSoft
2007-07-12 14:19 <REP> d-------- C:\Program Files\Fichiers communs\Scansoft Shared
2007-07-12 14:19 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
2007-07-12 14:18 <REP> d-------- C:\Program Files\ScanSoft
2007-07-12 14:17 <REP> d-------- C:\WINDOWS\speech
2007-07-12 10:32 <REP> d-------- C:\Program Files\CDisplay
2007-07-11 14:29 <REP> d-------- C:\Program Files\Combined Community Codec Pack
2007-07-02 21:27 <REP> d-------- C:\Program Files\Artefacts Studio
2007-06-30 18:11 1,726 --a------ C:\WINDOWS\system32\tmp.reg
2007-06-30 17:16 6,108 --a------ C:\dnsbak.reg
2007-06-30 16:22 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-29 20:30 <REP> d-------- C:\Program Files\a-squared Free
2007-06-27 11:59 <REP> d-------- C:\DOCUME~1\KIRCHE~1\APPLIC~1\ItsLabel
2007-06-27 11:58 <REP> d-------- C:\DOCUME~1\KIRCHE~1\APPLIC~1\EoRezo
2007-06-22 18:25 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-06-22 18:25 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-06-22 18:25 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-06-22 18:25 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-06-22 18:24 <REP> d-------- C:\WINDOWS\system32\AGEIA
2007-06-22 18:24 <REP> d-------- C:\Program Files\AGEIA Technologies
2007-06-22 18:18 <REP> d-------- C:\DOCUME~1\KIRCHE~1\APPLIC~1\dp3d
2007-06-22 18:17 <REP> d-------- C:\Program Files\Two Worlds Pinball
2007-06-22 18:11 <REP> d-------- C:\Program Files\Reality Pump
2007-06-21 13:15 <REP> d-------- C:\DOCUME~1\KIRCHE~1\APPLIC~1\SystemRequirementsLab
2007-06-21 10:17 <REP> d-------- C:\Program Files\Mindscape

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-21 14:07:01 -------- d-----w C:\Program Files\Hijackthis Version Française
2007-07-21 12:47:30 -------- d-----w C:\DOCUME~1\KIRCHE~1\APPLIC~1\Azureus
2007-07-19 16:10:23 -------- d-----w C:\Program Files\World of Warcraft
2007-07-19 11:07:36 -------- d-----w C:\DOCUME~1\KIRCHE~1\APPLIC~1\OpenOffice.org2
2007-07-18 18:21:59 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-18 14:30:19 -------- d-----w C:\DOCUME~1\KIRCHE~1\APPLIC~1\Lavasoft
2007-07-18 14:29:13 -------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-07-12 16:49:14 541,290 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-07-12 16:49:13 90,974 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-07-12 15:56:38 -------- d-----w C:\Program Files\MatroskaProp
2007-07-11 10:36:09 -------- d-----w C:\Program Files\Matroska Pack
2007-07-06 08:47:11 -------- d-----w C:\Program Files\MSN Messenger
2007-07-05 15:44:00 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat
2007-06-22 09:14:21 -------- d-----w C:\Program Files\Azureus
2007-06-20 13:49:40 -------- d-----w C:\Program Files\WowCartographe
2007-06-18 09:12:52 -------- d-----w C:\Program Files\Fichiers communs\Cheewoo
2007-06-18 09:12:31 -------- d-----w C:\Program Files\Cheewoo
2007-06-14 19:37:10 -------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2007-06-14 13:26:50 1,156 ----a-w C:\WINDOWS\mozver.dat
2007-06-14 13:08:39 -------- d-----w C:\Program Files\Sygate
2007-06-14 10:04:46 0 ----a-w C:\WINDOWS\nsreg.dat
2007-06-09 09:57:14 -------- d-----w C:\Program Files\Fichiers communs\Teleca Shared
2007-06-09 09:17:16 -------- d-----w C:\Program Files\MSXML 4.0
2007-06-08 16:37:28 -------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-06-05 09:29:22 -------- d-----w C:\DOCUME~1\KIRCHE~1\APPLIC~1\Gearbox Software
2007-06-04 13:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 13:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 13:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-04 06:40:02 -------- d--h--r C:\DOCUME~1\KIRCHE~1\APPLIC~1\SecuROM
2007-06-04 06:40:00 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-06-01 08:50:32 -------- d-----w C:\Program Files\DivX
2007-05-31 11:31:27 -------- d-----w C:\Program Files\Fichiers communs\DirectX
2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-29 10:20:33 -------- d-----w C:\Program Files\Canon
2007-05-28 08:06:07 -------- d-----w C:\Program Files\directx
2007-05-27 10:44:28 -------- d-----w C:\DOCUME~1\KIRCHE~1\APPLIC~1\InstallShield
2007-05-22 09:21:45 -------- d-----w C:\Program Files\CONEXANT
2007-05-16 15:13:53 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-07 11:59:32 2,553 ----a-w C:\WINDOWS\system32\sdbackup.reg
2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-04-25 14:22:35 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2004-08-05 12:00:00 87,057 --sh--r C:\WINDOWS\system32\comyobap.exe
2004-08-05 12:00:00 75,017 --sh--r C:\WINDOWS\system32\edconss.exe
2004-08-05 12:00:00 70,376 --sh--r C:\WINDOWS\system32\escsn.exe
2004-08-05 12:00:00 71,625 --sh--r C:\WINDOWS\system32\ikern32.exe
2004-08-05 12:00:00 72,458 --sh--r C:\WINDOWS\system32\rdsruns.exe
2004-08-05 12:00:00 51,650 --sh--r C:\WINDOWS\system32\xmlemppt.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 --a------ C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 C:\WINDOWS\system32\nvmctray.dll]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 16:00]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 12:41]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2006-03-21 02:34]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2007-07-19 13:28]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{075e67eb-2303-11dc-a114-000c6ebc693d}]
AutoRun\command- F:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7644764d-0205-11dc-a0da-000c6ebc693d}]
AutoRun\command- I:\autorun\autorun.exe

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-21 16:13:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-21 16:15:21 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-21 16:15
C:\ComboFix2.txt ... 2007-07-21 14:19

--- E O F ---

Réponse 22 / 43

Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 322

Re,

Peux tu analyser 5 fichiers stp:

C:\WINDOWS\system32\comyobap.exe
C:\WINDOWS\system32\edconss.exe
C:\WINDOWS\system32\escsn.exe
C:\WINDOWS\system32\ikern32.exe
C:\WINDOWS\system32\rdsruns.exe
C:\WINDOWS\system32\xmlemppt.exe

Vas sur le site https://virusscan.jotti.org/
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
Cherche le 1er fichier de la liste ci dessu!
- Clic sur submit toujours en haut à droite
- Le scan va se lancer, ça va prendre un petit instant
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799

Merci :)

Réponse 23 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

voila pour comyobap

Service load: 0% 100%

File: comyobap.exe
Status: INFECTED/MALWARE
MD5: e5deb29a78571abd3b8405b7fd882e7f
Packers detected: -
Bit9 reports: No threat detected (more info)

Scanner results
Scan taken on 21 Jul 2007 14:33:30 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.PCMM.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found IRC/BackDoor.SdBot3.CCI
BitDefender Found Backdoor.SDBot.DEOM
ClamAV Found Trojan.SdBot-6319
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Backdoor.Win32.SdBot.baa
Fortinet Found W32/SDBot.BAA!tr.bdr
Kaspersky Anti-Virus Found Backdoor.Win32.SdBot.baa
NOD32 Found IRC/SdBot
Norman Virus Control Found W32/SDBot.AQTM
Panda Antivirus Found nothing
Rising Antivirus Found Backdoor.Win32.SdBot.h
Sophos Antivirus Found Mal/EncPk-AC
VirusBuster Found nothing
VBA32 Found Backdoor.Win32.SdBot.baa

Réponse 24 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

voila pour edconss

Service load: 0% 100%

File: edconss.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: d0977fe68abe69160f6a002a1b1ce0d6
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 21 Jul 2007 14:40:26 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.PCMM.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found Downloader.Tibs.6.C
BitDefender Found Trojan.Proxy.Slaper.P
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found BackDoor.Mailbot
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan-Proxy.Win32.Slaper.p
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan-Proxy.Win32.Slaper.p
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found Trj/Agent.FTR
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/EncPk-AC
VirusBuster Found nothing
VBA32 Found nothing

Réponse 25 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

pour escsn

Service load: 0% 100%

File: escsn.exe
Status: INFECTED/MALWARE
MD5: e2a88b2a28f17a0a736c2d8769c08832
Packers detected: -
Bit9 reports: No threat detected (more info)

Scanner results
Scan taken on 21 Jul 2007 14:45:58 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.PCMM.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found Proxy.QEG
BitDefender Found Trojan.Proxy.Slaper.N
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found BackDoor.Mailbot
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan-Proxy.Win32.Slaper.n
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan-Proxy.Win32.Slaper.n
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found W32/Mailbot.DL.worm
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/EncPk-AC
VirusBuster Found nothing
VBA32 Found BackDoor.Mailbot

Réponse 26 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

et pour ikern32

Service load: 0% 100%

File: ikern32.exe
Status: INFECTED/MALWARE
MD5: d9a5898ea6c36e25e6c84a73987a91e1
Packers detected: -
Bit9 reports: No threat detected (more info)

Scanner results
Scan taken on 21 Jul 2007 14:50:37 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.PCMM.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found Downloader.Tibs.5.AZ
BitDefender Found Trojan.Proxy.Slaper.P
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found BackDoor.Mailbot
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan-Proxy.Win32.Slaper.p
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan-Proxy.Win32.Slaper.p
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found Trj/Mailbot.AZ
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/EncPk-AC
VirusBuster Found nothing
VBA32 Found BackDoor.Mailbot

Réponse 27 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

pour rdsruns

Service load: 0% 100%

File: rdsruns.exe
Status: INFECTED/MALWARE
MD5: f074f6c851c078c19caf73632aee57ad
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 21 Jul 2007 14:54:23 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.PCMM.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found Downloader.Tibs.5.AZ
BitDefender Found Trojan.Proxy.Slaper.U
ClamAV Found nothing
CPsecure Found Troj.Proxy.W32.Slaper.U
Dr.Web Found BackDoor.Mailbot
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan-Proxy.Win32.Slaper.u
Fortinet Found W32/Slaper.U!tr
Kaspersky Anti-Virus Found Trojan-Proxy.Win32.Slaper.u
NOD32 Found nothing
Norman Virus Control Found W32/Slaper.FN
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/EncPk-AC
VirusBuster Found nothing
VBA32 Found Trojan-Proxy.Win32.Slaper.u

Réponse 28 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

et le petit dernier xmlemppt

Service load: 0% 100%

File: xmlemppt.exe
Status: INFECTED/MALWARE
MD5: c84e59ef8d4e831eea34385dc3285f9a
Packers detected: -
Bit9 reports: No threat detected (more info)

Scanner results
Scan taken on 21 Jul 2007 14:58:46 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.PCMM.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found SpamTool.ACA
BitDefender Found Trojan.Proxy.Slaper.P
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found BackDoor.Mailbot
F-Prot Antivirus Found W32/Trojan.AWMZ
F-Secure Anti-Virus Found Trojan-Proxy.Win32.Slaper.p
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan-Proxy.Win32.Slaper.p
NOD32 Found Win32/SpamTool.Agent.NAE
Norman Virus Control Found W32/Malware.XUL
Panda Antivirus Found Bck/Agent.FTS
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/EncPk-AC
VirusBuster Found nothing
VBA32 Found BackDoor.Mailbot

voili voilou j'espere que c'etait bien ca qu'il fallai faire et que ca va servir

Réponse 29 / 43

Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 322

Re,

Avast une vraie passoire....Changer d'antivirus ne t'interresses pas?

Avec Otmoveit, supprime ceci:
C:\WINDOWS\system32\comyobap.exe
C:\WINDOWS\system32\edconss.exe
C:\WINDOWS\system32\escsn.exe
C:\WINDOWS\system32\ikern32.exe
C:\WINDOWS\system32\rdsruns.exe
C:\WINDOWS\system32\xmlemppt.exe

A+

Réponse 30 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

voila le rapport MOVEIT

C:\WINDOWS\system32\comyobap.exe moved successfully.
C:\WINDOWS\system32\edconss.exe moved successfully.
C:\WINDOWS\system32\escsn.exe moved successfully.
C:\WINDOWS\system32\ikern32.exe moved successfully.
C:\WINDOWS\system32\rdsruns.exe moved successfully.
C:\WINDOWS\system32\xmlemppt.exe moved successfully.

Created on 07/21/2007 17:40:21

Que me connseillerais tu comme antivirus ?
considere tu le probleme comme resolu
merci de m'aider

Réponse 31 / 43

Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 322

Salut

Ou en sont tes soucis? Ceux du départ??

Je te propose a la place d'Avast, l'antivirus gratuit Antivir.
Il est certes en anglais mais sa réactivité est tres forte. De plus, il n y a que qqs mots anglais a connaitre, rien de bien méchant.

Qu'en penses tu?

A+

Réponse 32 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

bah par apport au debut je n' ai plus de fichier temporaire dans mon gestionnaire des taches je n ai plus de PUB enfin a l'heure qu'il est mais ne faisant une derniere analyse avec spybot il me trouve encore 1 spyware FastCLick mais bon tant qu il ne me derange pas ca va. merci bien de votre aide et je vais voir a changer d'antivirus.

Réponse 33 / 43

Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 322

Salut,

Je pense qu'il ne faut pas réagir comme ca!
Pourquoi?

Tu me dis, j ai un malware (ok ca arrive) mais tu me dis "tant qu il m embete pas je m'en fou."
Donc si je t installe un trojan pour t'espionner, pour prendre tes coordonnees bancaires etc... tant que ton antivirus te dis rien, tu t'en fous aussi?

Je pense que tu devrais te soucier un peu plus de ton pc :-)
Y'a des malwares, on les extermine mais on a attend pas qu il t'embete, non?

Télécharge Antivir:
antivir

Désinstalles Avast et installe Antivir.

Une fois fait, scanne ton PC avec Antivir si tu as le temps, sinon, c est pas grave; il le fera en scanne résident.

Essaie de corriger les problemes avec Spybot, s'il est toujours présent, tu copie/colle le rapport de Spybot ici.

A+

Réponse 34 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

voila le rapport SPYBOT :

--- Search result list ---
DoubleClick: Cookie traceur (Firefox: default) (Cookie, nothing done)

FastClick: Cookie traceur (Firefox: default) (Cookie, nothing done)

FastClick: Cookie traceur (Firefox: default) (Cookie, nothing done)

FastClick: Cookie traceur (Firefox: default) (Cookie, nothing done)

FastClick: Cookie traceur (Firefox: default) (Cookie, nothing done)

MediaPlex: Cookie traceur (Firefox: default) (Cookie, nothing done)

--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2007-06-30 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-05-23 advcheck.dll (1.5.3.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-01-02 Tools.dll (2.0.1.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-07-18 Includes\Cookies.sbi (*)
2007-05-30 Includes\Dialer.sbi (*)
2007-07-18 Includes\DialerC.sbi (*)
2007-07-11 Includes\Hijackers.sbi (*)
2007-07-18 Includes\HijackersC.sbi (*)
2007-07-11 Includes\Keyloggers.sbi (*)
2007-07-18 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2007-07-18 Includes\Malware.sbi (*)
2007-07-18 Includes\MalwareC.sbi (*)
2007-07-11 Includes\PUPS.sbi (*)
2007-07-18 Includes\PUPSC.sbi (*)
2007-07-18 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-07-18 Includes\SecurityC.sbi (*)
2007-07-11 Includes\Spybots.sbi (*)
2007-07-18 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2007-07-18 Includes\Trojans.sbi (*)
2007-07-18 Includes\TrojansC.sbi (*)
2007-06-06 Plugins\TCPIPAddress.dll

--- System information ---
Windows XP (Build: 2600) Service Pack 2
/ .NETFramework / 1.1: Microsoft .NET Framework 1.1 Hotfix (KB928366)
/ .NETFramework / 1.1: Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
/ Microsoft .NET Framework 2.0: This Security Update is for Microsoft .NET Framework 2.0. \n
If you later install a more recent service pack, this Security Update will be uninstalled automatically. \n
For more information, visit https://support.microsoft.com/en-us/help/917283/ms06-033-a-vulnerability-in-asp-net-could-allow-information-disclosure
/ Microsoft .NET Framework 2.0: This Security Update is for Microsoft .NET Framework 2.0. \n
If you later install a more recent service pack, this Security Update will be uninstalled automatically. \n
For more information, visit https://support.microsoft.com/en-us/help/922770
/ Microsoft .NET Framework 2.0: This Security Update is for Microsoft .NET Framework 2.0. \n
If you later install a more recent service pack, this Security Update will be uninstalled automatically. \n
For more information, visit https://support.microsoft.com/en-us/help/928365/description-of-the-security-update-for-the-net-framework-2-0-for-windo
/ MSXML4SP2: FIX: ASP stops responding when calling Response.Redirect to another server using msxml4 sp2
/ Step By Step Interactive Training / SP2: Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)
/ Windows / SP1: Microsoft Internationalized Domain Names Mitigation APIs
/ Windows / SP1: Microsoft National Language Support Downlevel APIs
/ Windows Media Format 11 SDK: Hotfix for Windows Media Format 11 SDK (KB929399)
/ Windows Media Player 6.4: Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)
/ Windows Media Player 9: Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734)
/ Windows Presentation Foundation: This Hotfix is for Microsoft .NET Framework 3.0. \n
If you later install a more recent service pack, this Hotfix will be uninstalled automatically. \n
For more information, visit https://support.microsoft.com/en-us/help/932471
/ Windows XP: Mise à jour de sécurité pour Windows XP (KB923689)
/ Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
/ Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)
/ Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
/ Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
/ Windows XP / SP10: Microsoft Compression Client Pack 1.0 for Windows XP
/ Windows XP / SP3: Correctif Windows XP - KB873339
/ Windows XP / SP3: Correctif Windows XP - KB883667
/ Windows XP / SP3: Correctif Windows XP - KB885250
/ Windows XP / SP3: Correctif Windows XP - KB885835
/ Windows XP / SP3: Correctif Windows XP - KB885836
/ Windows XP / SP3: Correctif Windows XP - KB886185
/ Windows XP / SP3: Correctif Windows XP - KB887472
/ Windows XP / SP3: Correctif Windows XP - KB888113

Réponse 35 / 43

Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 322

OK

Tu as installé Antivir?

Ce sont des cookies, rien de grave, as tu ccleaner par exemple?

A+

Réponse 36 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

voila j ai installé antivir je fai une analyse complete de mon disc dur . non je n'ai pas Ccleaner.

Réponse 37 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

j'ai finis de scanner avec ANTIVIR voila le rapport

AntiVir PersonalEdition Classic
Report file date: dimanche 22 juillet 2007 14:31

Scanning for 973000 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: kirchener
Computer name: CCCP-E51810C423

Version information:
BUILD.DAT : 247 14437 Bytes 10/05/2007 11:55:00
AVSCAN.EXE : 7.0.4.15 282664 Bytes 20/04/2007 11:37:14
AVSCAN.DLL : 7.0.4.4 33832 Bytes 27/03/2007 11:31:54
LUKE.DLL : 7.0.4.11 143400 Bytes 27/03/2007 11:26:04
LUKERES.DLL : 7.0.4.0 10280 Bytes 19/03/2007 11:18:59
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 13:08:58
ANTIVIR1.VDF : 6.39.0.129 7251968 Bytes 10/07/2007 12:27:57
ANTIVIR2.VDF : 6.39.0.148 395776 Bytes 16/07/2007 12:27:57
ANTIVIR3.VDF : 6.39.0.175 345088 Bytes 21/07/2007 12:27:57
AVEWIN32.DLL : 7.4.0.44 2499072 Bytes 22/07/2007 12:27:57
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26
AVPREF.DLL : 7.0.2.1 24616 Bytes 27/03/2007 11:31:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24
AVPACK32.DLL : 7.3.0.13 360488 Bytes 22/07/2007 12:27:57
AVREG.DLL : 7.0.1.2 31784 Bytes 15/03/2007 08:05:08
AVEVTLOG.DLL : 7.0.0.18 86056 Bytes 27/03/2007 11:16:05
AVARKT.DLL : 1.0.0.17 278568 Bytes 02/05/2007 10:32:26
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42
RCIMAGE.DLL : 7.0.1.15 2228264 Bytes 13/03/2007 09:46:18
RCTEXT.DLL : 7.0.45.0 86056 Bytes 19/03/2007 11:42:42

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 22 juillet 2007 14:31

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'Spywareterminatorshield.Exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'sp_rsser.exe' - '1' Module(s) have been scanned
Scan process 'SMAgent.exe' - '1' Module(s) have been scanned
Scan process 'Smc.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
29 processes with 29 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'A:\'
[NOTE] In the drive 'A:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '10' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\kirchener\Bureau\VundoFix.exe
[DETECTION] Is the Trojan horse TR/Dldr.Agent.69632
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\epkoihuu.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\fcccawu.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\gdpffmit.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\gdxxnhvh.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\gebbaab.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\gtamptst.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\kkbdyiuw.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\mljgeda.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\ohxykqvu.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\pdyevlum.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\tjmmnwey.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\uhngjver.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\urqppmn.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\vgyfmpdl.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\vtutqpn.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\wgpyrpjw.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[INFO] The file was deleted!
C:\VundoFix Backups\awtrrpm.dll.bad
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\VundoFix Backups\bifolouo.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\VundoFix Backups\efcbbcy.dll.bad
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\VundoFix Backups\eyudnyyi.dll.bad
[DETECTION] Is the Trojan horse TR/JuanSearch.B
[INFO] The file was deleted!
C:\VundoFix Backups\geedc.dll.bad
[DETECTION] Is the Trojan horse TR/Mon.Virtumonde.II
[INFO] The file was deleted!
C:\VundoFix Backups\gpskdwix.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\VundoFix Backups\hbpcmtsy.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\VundoFix Backups\hvtbewfq.dll.bad
[DETECTION] Is the Trojan horse TR/Juan.H
[INFO] The file was deleted!
C:\VundoFix Backups\kcxkvlmn.dll.bad
[DETECTION] Is the Trojan horse TR/JuanSearch.C.1
[INFO] The file was deleted!
C:\VundoFix Backups\lcwpikrf.dll.bad
[DETECTION] Is the Trojan horse TR/JuanSearch.C.1
[INFO] The file was deleted!
C:\VundoFix Backups\mahhbdvb.dll.bad
[DETECTION] Is the Trojan horse TR/JuanSearch.C
[INFO] The file was deleted!
C:\VundoFix Backups\mhcybact.dll.bad
[DETECTION] Is the Trojan horse TR/JuanSearch.C
[INFO] The file was deleted!
C:\VundoFix Backups\mljji.dll.bad
[DETECTION] Is the Trojan horse TR/Mon.Virtumonde.II
[INFO] The file was deleted!
C:\VundoFix Backups\nibcshmq.dll.bad
[DETECTION] Is the Trojan horse TR/JuanSearch.C
[INFO] The file was deleted!
C:\VundoFix Backups\nnnmkhe.dll.bad
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\VundoFix Backups\nxsqhnvu.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\VundoFix Backups\opnmmmk.dll.bad
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\VundoFix Backups\pmnno.dll.bad
[DETECTION] Is the Trojan horse TR/Mon.Virtumonde.II
[INFO] The file was deleted!
C:\VundoFix Backups\qupxuenn.dll.bad
[DETECTION] Is the Trojan horse TR/JuanSearch.C
[INFO] The file was deleted!
C:\VundoFix Backups\retfxcri.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\VundoFix Backups\uayxnsvt.dll.bad
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[INFO] The file was deleted!
C:\VundoFix Backups\umnnooau.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\VundoFix Backups\vngthdqw.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\VundoFix Backups\vtsqo.dll.bad
[DETECTION] Is the Trojan horse TR/BHO.BD.13
[INFO] The file was deleted!
C:\VundoFix Backups\ymbahxmq.dll.bad
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[INFO] The file was deleted!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\etc\hosts.20070630-164428.backup
[DETECTION] Is the Trojan horse TR/AntiHosts.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\htrefreghreger.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\twesdwdewewd.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\comyobap.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\edconss.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\escsn.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\ikern32.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\rdsruns.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\xmlemppt.exe
[DETECTION] Is the Trojan horse TR/Crypt.PCMM.Gen
[INFO] The file was deleted!
Begin scan in 'A:\'
Search path A:\ could not be opened!
Le volume ne contient pas de système de fichiers connu. Vérifiez si tous les pilotes de système
de fichiers nécessaires sont chargés et si le volume n'est pas endommagé.

Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.

End of the scan: dimanche 22 juillet 2007 15:51
Used time: 1:20:36 min

The scan has been done completely.

4720 Scanning directories
257131 Files were scanned
51 viruses and/or unwanted programs were found
0 classified as suspicious:
51 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
257080 Files not concerned
1932 Archives were scanned
2 Warnings
19 Notes
0 Hidden objects were found

Réponse 38 / 43

Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 322

OK !

Ccleaner :

https://www.malekal.com/tutoriel-ccleaner/

Et ensuite relance Spybot.

A++

Réponse 39 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

bon bah apres avoir utilisé Ccleaner en raifaisant un analyse spybot ilm ne detecte plus aucun mouchard. j'espere que ca va continuer. Merci beaucoup de votre aide.

Réponse 40 / 43

kirchener Messages postés 33 Date d'inscription Statut Membre Dernière intervention

J'aurais juste une derniere question je combine ANTIVIR avec son gardien , SPYWARE TERMINATOR et sa protection en temp réel et SYGATE PERSONAL FIREWALL esque c est utile ou je dois en supprimer un ?
merci

J'ai un probléme dee spyware je ne sias plus

43 réponses

Votre réponse