virus win 32

Question

Bonjour, 
J'ai un virus sur mon ordi (j'ai windows xp). Je suis allée sur le site d'antivirus en ligne secuser et j'ai lancé un scan, pendant le scan, mon anti virus avast, c'est mis en alerte. Il a trouvé un logiciel malveillant dans mon disque C dans: C:\DOCUME~1\ELODIE~1\LOCALS~1	emp\V4JKQUa02956, il dit que le nom du logiciel est : Win32:Agent-MJG et que c'est un dropper. Je ne peux ni le supprimer, ni le mettre en quarantaine.

En plus, je ne sais pas si c'est lié au reste mais lorsque je quitte internet, une fenêtre s'ouvre et indique : iexplorer.exe, L'instruction à "0x02bb9a1c" emploie l'adresse mémoire "0x02bb9a1c". La mémoire ne peut pas être read. Cliquez sur ok pour terminer le programme.
J'espère que quelqu'un pourra m'aider pour enlever ce virus. Merci d'avance.

clownface · Answer

Bonsoir,

télécharge : hijackthis
Utilisation :

    * L'installer dans un dossier prévu à cet effet.
          o Par exemple, C:\HijackThis
          o Choisis l'option "do a system scan and save a logfile"; un rapport va être généré… 

colles ce rapport ici.

élo · Answer

Salut, j'ai fait ce que tu m'as dit, voici le rapport : 
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\VTtrayp.exe
C:\WINDOWS\System32\VTTimer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ELODIE~1\LOCALS~1\Temp\Rar$EX00.375\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: IE - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAIDaid_tool.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - https://www.afternic.com/domains/drivecleaner.com
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.snapfish.fr/2/home
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AF8D9C56-4FC7-4B46-B103-9A103C40707B}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: pushow1.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

clownface · Answer

bonsoir,

1ère chose : installer correctement hijacthis, il doit avoir son propre dossier sur c:\

ensuite, tu vas faire ceci : scan avec avg anti spyware (en mode sans echec + efficace https://www.malekal.com/demarrer-windows-mode-sans-echec/ )

puis un scan antivirus en ligne www.bitdefender.com/scan8/ie.html 
postes les rapports avg et antivirus

élo · Answer

Bonjour,

Désolé de ne pas avoir répondu plus tôt, mais bien occupé avec le boulot. Voici les rapports : 


AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	23:05:11 26/10/2007

 + Résultat de l'analyse:	



HKLM\SOFTWARE\Classes\CLSID\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} -> Adware.Generic : Nettoyé.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} -> Adware.Generic : Nettoyé.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Erreur lors du nettoyage.
HKU\S-1-5-21-117609710-789336058-839522115-1003\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
C:\WINDOWS\Downloaded Program Files\UDC6V_0001_D19M0709NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.m : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@livenation.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Elodie&Rémi\Cookies\elodie&rémi@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.


Fin du rapport


BitDefender Online Scanner
     
Scan report generated at: Fri, Oct 26, 2007 - 23:47:55
    
Scan path: A:\;C:\;D:\;E:\;F:\;G:\;
  
  
Statistics
 
Time
 00:30:13
 
Files
 143808
 
Folders
 3309
 
Boot Sectors
 4
 
Archives
 1708
 
Packed Files
 7739
 
  
  
 
Results
 
Identified Viruses 
 1
 
Infected Files 
 16
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 16
 
  
  
 
Engines Info
 
Virus Definitions
 858323
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 14
 
Archive plugins
 38
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 1
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
 Infected with: Trojan.Agent.ABPI
 
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
 Disinfection failed
 
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062761.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062761.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062761.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062762.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062762.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062762.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062763.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062763.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062763.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062764.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062764.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062764.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062765.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062765.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062765.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062766.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062766.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062766.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062767.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062767.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062767.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062768.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062768.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062768.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062769.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062769.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062769.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062771.EXE
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062771.EXE
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062771.EXE
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062772.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062772.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062772.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062773.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062773.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062773.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062774.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062774.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062774.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062775.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062775.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP578\A0062775.exe
 Deleted
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP601\A0064106.exe
 Infected with: Trojan.Agent.ABPI
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP601\A0064106.exe
 Disinfection failed
 
C:\System Volume Information\_restore{F8F4B10F-BB4E-41CB-B684-248A1900C4AC}\RP601\A0064106.exe
 Deleted
 

J'espère qu'avec ces rapports, tu pourras me dire ce qu'il faut que je fasse. Merci.

clownface · Answer

Bonjour,

désactive ta restauration system, 
redemarre,
reactive la restauration system

refais un scan avec bitdefendeur (qui trouvera plus rien.. tu me confirmeras)
et repostes un rapport hijackthis

élo · Answer

Salut, j'ai désactivé et réactivé la restauration système comme tu me l'avais dit. Voici le rapport de bitdefender, apparament il n'a rien trouvé : 

BitDefender Online Scanner
    
Scan report generated at: Sun, Oct 28, 2007 - 21:20:22
 
Scan path: A:\;C:\;D:\;E:\;F:\;G:\;
  
   
Statistics
 
Time
 00:30:47
 
Files
 139344
 
Folders
 3031
 
Boot Sectors
 4
 
Archives
 1718
 
Packed Files
 7664
  
 
Results
 
Identified Viruses 
 0
 
Infected Files 
 0
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 0
 
  
Engines Info
 
Virus Definitions
 858550
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 14
 
Archive plugins
 38
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 1
 
  
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
No virus found.

Et voici le rapport de hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:22:50, on 28/10/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\VTtrayp.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\VTTimer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAIDaid_tool.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - https://www.afternic.com/domains/drivecleaner.com
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.snapfish.fr/2/home
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AF8D9C56-4FC7-4B46-B103-9A103C40707B}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: pushow1.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

clownface · Answer

Bonsoir,

redemarre en mode sans echec,  https://www.malekal.com/demarrer-windows-mode-sans-echec/
relances hijackthis et coches ces lignes :

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - https://www.afternic.com/domains/drivecleaner.com
O20 - AppInit_DLLs: pushow1.dll

cliques sur fix checked.

reviens en mode normal, et repostes un rapport hijackthis.

élo · Answer

Bonjour, j'ai fait ce que tu m'as demander, voici le rapport : 


 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:54:06, on 31/10/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:A
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exeA
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\VTtrayp.exe
C:\WINDOWS\System32\VTTimer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAIDaid_tool.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.snapfish.fr/2/home
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AF8D9C56-4FC7-4B46-B103-9A103C40707B}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

clownface · Answer

Bonsoir,

relances hijackthis et coches ces lignes :
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - https://www.afternic.com/domains/drivecleaner.com
cliques sur fix checked.

ensuite, Télécharge Look2Me-Destroyer.exe sur ton Bureau. 

http://www.atribune.org/ccount/click.php?id=7 

* Ferme toutes les fenêtres actives avant de passer à l'étape suivante. 
* Double-clique Look2Me-Destroyer.exe afin de lancer l'outil. 
* Coche "Run this program as a task" 
* Un message s'affichera, te disant ceci : "Look2Me-Destroyer will close and re-open in approximately 10 seconds". Clique [OK] 
* Il se relancera après les 10 secondes, puis clique sur le bouton "Scan for L2M"; les icônes de ton Bureau vont disparaître : c'est normal ! 
* Lorsque le scan termine, clique sur le bouton "Remove L2M" 
* Un message "Done Scanning" apparaîtra, clique [OK]. 
* Un nouveau message s'affichera : "Done removing infected files! Look2Me-Destroyer will now shutdown your computer"; clique [OK]. 
* Ton PC va maintenant s'éteindre. 
* Démarre ton PC normalement. 
* Colle le rapport généré, situé ici : C:\Look2Me-Destroyer.txt , ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

élo · Answer

Les lignes que tu me demande de cocher dans hijackthis n'y sont plus. Je continue la procédure que tu m'as données?

clownface · Answer

arf dsl.. non j'vais regarder le dernier hijackthis..

clownface · Answer

le dernier hijackthis est ok,

il ne te reste plus qu'à installer un parefeu : http://www.commentcamarche.net/faq/sujet 3486 s curit le parefeu de windows xp
faire la mise à jour java : http://www.commentcamarche.net/forum/affich 3711157 maj critique java par jalobservateur#0

élo · Answer

Salut, j'avais fait tout ce que tu m'as demander. Je croyais que c'était bon mais mon anti virus avast redétecte un virus dans mon disque dur C, soit dans programme files, soit dans windows. C'est toujours Win32: Agent-MJG, de type dropper.
J'espère que tu pourras encore m'aider. Merci d'avance.

clownface · Answer

Bonsoir,

on va commencer par changer l'antivirus et faire un scan : http://forum.malekal.com/ftopic4192.php
postes le rapport.

élo · Answer

Désolé de ne pas avoir répondu. Mais changer mon antivirus ça me dit pas trop. Beaucoup de personnes m'ont  conseignées avast. Et là j'ai l'impression que j'ai plus rien sur mon ordi. Merci encore.

clownface · Answer

bonsoir,

c'est toi qui voit
bonne continuation

Virus win 32

16 réponses

Discussions similaires

Newsletters