probleme avec navilog (suite trojan+adware)Fermé

Question

Bonjour, 

Suite à une mauvaise rencontre avec 2 trojan + 1 adware, j'ai installé Navilog1 mais après avoir fait toutes les manip, quand je veux avoir le rapport bloc notes je n'ai rien !!!
J'ai pour message : "impossible de trouver le fichier c:\fixnavi.txt. Voulez vous créer un nouveau fichier ?" 

(pour info je travaille sur vista, antivirus Avast et voici les trojan et l'adware trouvés : trojan N°1 win32:IRCBOT-CFZ[Trj] ///// Trojan N°2 win32 : mailskinner [Trj] ////Adware win32 : navipromo - H [Adw]. Je les ai mis en quarantaine pour le moment.

Que faire avec navilog ?

Merci d'avance pour vos réponses
colibri29

jlpjlp · Answer

slt,


colle un rapport hijackthis 
 
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html


Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."


__________________





Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 

- Va dans démarrer puis panneau de configuration 
- Double Clique sur l'icône "Comptes d'utilisateurs" 
- Clique ensuite sur désactiver et valide. 

Télécharge maintenant Navilog1 depuis-ce lien : 

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter 

en tant qu'administrateur". 

Au menu principal, Fais le choix 1 
Laisse toi guider et patiente. 
Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche le blocnote va s'ouvrir. 
Copie-colle l'intégralité du rapport dans une réponse. 
Referme le blocnote 
Le rapport fixnavi.txt est en outre sauvegardé dans %systemdrive%.

jlpjlp · Answer

Veille à ce que le contrôle des comptes utilisateurs (UAC) soit désactivé.
Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter en tant qu'administrateur". 

Au menu principal, Fais le choix 2
Laisse toi guider et patiente. 
Le fix va t'informer qu'il va alors redémarrer ton PC 
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts 
Appuie sur une touche comme demandé. 
(si ton Pc ne redémarre pas automatiquement, fais-le toi-même) 
Au redémarrage de ton PC, choisis ta session habituelle si nécessaire. 
Patiente jusqu'au message : 
*** Nettoyage Termine le ..... *** 
Le blocnote va s'ouvrir. 
Sauvegarde le rapport de manière à le retrouver 
Referme le blocnote. Ton bureau va réapparaître 
Réactive le contrôle des comptes utilisateurs (UAC)

PS:Si ton bureau ne réapparaît pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches. 
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter" 
Tape explorer et valide. Cela te fera apparaître ton bureau




_____________________

encore des problemes?

recolle un rapport hijackthis

jlpjlp · Answer

si tu ne peux desactiver, ce qui me parait bizarre car je l'ai fait faire a plusieurs personne sans probleme




lance:


panda antirootkit 

https://www.zdnet.fr/telecharger/logiciel/panda-free-antivirus-39647425s.htm

et

Lance AVG ANTI ROOTKIT :

http://www.libellules.ch/dotclear/index.php?2007/03/28/1781-avg-anti-rootkit



puis recolle un rapport navilog avec l'option 1
pour voir ce qu'il reste

jlpjlp · Answer

oui il ne l'a&i pas encore je pense

fais avg antirootkit qui lui l'est

jlpjlp · Answer

non avg anti rootkit est gratuit et marche sous vista lance le

http://www.libellules.ch/dotclear/index.php?2007/03/28/1781-avg-anti-rootkit



____________

si tu peux vraiment pas ce qui m'etonnerai car j'ai essayé
utilise Catchme

http://www.commentcamarche.net/faq/sujet 2490 popups ouverture de fenetres internet publicitaires pop up

jlpjlp · Answer

il reste ca que tu peux supprimer avec navilog

ou en utilisant la deuxieme methode sur le lien


C:\Windows\pack.epk trouvé !
C:\Windows\system32
vs2.inf trouvé !




a plus

jlpjlp · Answer

Au menu principal, Fais le choix 2
Laisse toi guider et patiente.
Le fix va t'informer qu'il va alors redémarrer ton PC
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuie sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais-le toi-même)
Au redémarrage de ton PC, choisis ta session habituelle si nécessaire.
Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le blocnote va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver
Referme le blocnote. Ton bureau va réapparaître
Réactive le contrôle des comptes utilisateurs (UAC)

PS:Si ton bureau ne réapparaît pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Cela te fera apparaître ton bureau

jlpjlp · Answer

scan avec des antiespions (en mode sans échec): 

spybot :  (si vous avez une version instalée avant sept 2007 changer là par la version 1.5)

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html 

voir demo d utilisation (merci Balltrap)
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm


__________________



recolle un rapport hijackthis et dis tes soucis

a plus










pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français   ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
AD AWARE + SPYBOT +/-    si tea timer non active de spybot: WINDOWS DEFENDER ou               SPYWARE TERMINATOR

+/-
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf

jlpjlp · Answer

remplace avast par antivir et colle moi le rapport

https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)

colibri29 · Answer

Avant d'installer antivir, est ce qu il faut que je desinstalle d'abord avast ?

jlpjlp · Answer

oui il faut d'abords virer avast

colibri29 · Answer

j ai viré Avast et j 'ai installé antivir.

Super cool le tuto de Malekal. Même moi j'arrive à comprendre !!!

Par contre avant de lancer un scan et de t'envoyer un rapport peux tu me confirmer 2 choses ?

- Le scan, je le fais uniquement sur Local hard disks ou aussi sur windows systeme directory et my documents ?

- Si Antivir découvre des p'tites bêtes sur mon pc, j' en fais quoi ? Suppression ? Quarantaine ? Renommer ? ou Ignorer ?

jlpjlp · Answer

- Le scan, je le fais uniquement sur Local hard disks ou aussi sur windows systeme directory et my documents ?


tu analyse tout


- Si Antivir découvre des p'tites bêtes sur mon pc, j' en fais quoi ? Suppression ? Quarantaine ? Renommer ? ou Ignorer ?


tu supprime

colibri29 · Answer

ok je me lance

je t envoi un rapport par la suite

colibri29 · Answer

ce fût long, mais antivir ne m'a rien detecté (à première vue !?) j'ai fait plusieurs scan, je les envoie à suivre. SCAN SUR LOCAL HARD DISKS AntiVir PersonalEdition Classic Report file date: mardi 27 novembre 2007 13:11 Scanning for 943200 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows Vista Windows version: (plain) [6.0.6000] Username: karine Computer name: PC-BOURNE Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 27/11/2007 11:23:12 AVSCAN.DLL : 7.0.6.0 49192 Bytes 27/11/2007 11:23:12 LUKE.DLL : 7.0.5.3 147496 Bytes 27/11/2007 11:23:12 LUKERES.DLL : 7.0.6.1 10280 Bytes 27/11/2007 11:23:12 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 11:23:13 ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 11:23:14 ANTIVIR2.VDF : 7.0.1.0 1393152 Bytes 23/11/2007 11:23:14 ANTIVIR3.VDF : 7.0.1.11 38400 Bytes 27/11/2007 11:23:14 AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 27/11/2007 11:23:14 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 27/11/2007 11:23:12 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24 AVPACK32.DLL : 7.3.0.15 360488 Bytes 27/11/2007 11:23:14 AVREG.DLL : 7.0.1.6 30760 Bytes 27/11/2007 11:23:12 AVARKT.DLL : 1.0.0.20 278568 Bytes 27/11/2007 11:23:12 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 27/11/2007 11:23:12 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 27/11/2007 11:23:01 RCTEXT.DLL : 7.0.62.0 86056 Bytes 27/11/2007 11:23:01 SQLITE3.DLL : 3.3.17.1 339968 Bytes 27/11/2007 11:23:12 Configuration settings for the scan: Jobname..........................: Local Hard Disks Configuration file...............: c:\program files\antivir personaledition classic\alldiscs.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mardi 27 novembre 2007 13:11 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 17 processes with 17 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '16' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: mardi 27 novembre 2007 13:43 Used time: 32:22 min The scan has been done completely. 11806 Scanning directories 206211 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 206211 Files not concerned 1816 Archives were scanned 1 Warnings 14 Notes

colibri29 · Answer

SCAN SUR WINDOWS SYSTEM DIRECTORY



AntiVir PersonalEdition Classic
Report file date: mardi 27 novembre 2007  13:47

Scanning for 943200 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows Vista
Windows version:  (plain)  [6.0.6000]
Username:         karine
Computer name:    PC-BOURNE

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  27/11/2007 11:23:12
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  27/11/2007 11:23:12
LUKE.DLL     : 7.0.5.3      147496 Bytes  27/11/2007 11:23:12
LUKERES.DLL  : 7.0.6.1       10280 Bytes  27/11/2007 11:23:12
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 11:23:13
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 11:23:14
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 11:23:14
ANTIVIR3.VDF : 7.0.1.11      38400 Bytes  27/11/2007 11:23:14
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  27/11/2007 11:23:14
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  27/11/2007 11:23:12
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  27/11/2007 11:23:14
AVREG.DLL    : 7.0.1.6       30760 Bytes  27/11/2007 11:23:12
AVARKT.DLL   : 1.0.0.20     278568 Bytes  27/11/2007 11:23:12
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  27/11/2007 11:23:12
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  27/11/2007 11:23:01
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  27/11/2007 11:23:01
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  27/11/2007 11:23:12

Configuration settings for the scan:
Jobname..........................: Windows System Directory
Configuration file...............: c:\program files\antivir personaledition classic\sysdir.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 27 novembre 2007  13:47

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
17 processes with 17 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '16' files ).


Starting the file scan:

Begin scan in 'C:\Windows\system32'


End of the scan: mardi 27 novembre 2007  13:51
Used time: 03:47 min

The scan has been done completely.

   1032 Scanning directories
  31686 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
  31686 Files not concerned
    172 Archives were scanned
      0 Warnings
      0 Notes

colibri29 · Answer

SCAN SUR MY DOCUMENT



AntiVir PersonalEdition Classic
Report file date: mardi 27 novembre 2007  13:56

Scanning for 943200 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows Vista
Windows version:  (plain)  [6.0.6000]
Username:         karine
Computer name:    PC-BOURNE

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  27/11/2007 11:23:12
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  27/11/2007 11:23:12
LUKE.DLL     : 7.0.5.3      147496 Bytes  27/11/2007 11:23:12
LUKERES.DLL  : 7.0.6.1       10280 Bytes  27/11/2007 11:23:12
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 11:23:13
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 11:23:14
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 11:23:14
ANTIVIR3.VDF : 7.0.1.11      38400 Bytes  27/11/2007 11:23:14
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  27/11/2007 11:23:14
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  27/11/2007 11:23:12
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  27/11/2007 11:23:14
AVREG.DLL    : 7.0.1.6       30760 Bytes  27/11/2007 11:23:12
AVARKT.DLL   : 1.0.0.20     278568 Bytes  27/11/2007 11:23:12
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  27/11/2007 11:23:12
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  27/11/2007 11:23:01
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  27/11/2007 11:23:01
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  27/11/2007 11:23:12

Configuration settings for the scan:
Jobname..........................: My Documents
Configuration file...............: c:\program files\antivir personaledition classic\mydocs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 27 novembre 2007  13:56

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
17 processes with 17 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '16' files ).


Starting the file scan:

Begin scan in 'C:\Users\karine\Documents'


End of the scan: mardi 27 novembre 2007  13:56
Used time: 00:12 min

The scan has been done completely.

     43 Scanning directories
    150 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
    150 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

colibri29 · Answer

SCAN SUR LOCAL DRIVERS AntiVir PersonalEdition Classic Report file date: mardi 27 novembre 2007 13:58 Scanning for 943200 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows Vista Windows version: (plain) [6.0.6000] Username: karine Computer name: PC-BOURNE Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 27/11/2007 11:23:12 AVSCAN.DLL : 7.0.6.0 49192 Bytes 27/11/2007 11:23:12 LUKE.DLL : 7.0.5.3 147496 Bytes 27/11/2007 11:23:12 LUKERES.DLL : 7.0.6.1 10280 Bytes 27/11/2007 11:23:12 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 11:23:13 ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 11:23:14 ANTIVIR2.VDF : 7.0.1.0 1393152 Bytes 23/11/2007 11:23:14 ANTIVIR3.VDF : 7.0.1.11 38400 Bytes 27/11/2007 11:23:14 AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 27/11/2007 11:23:14 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 27/11/2007 11:23:12 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24 AVPACK32.DLL : 7.3.0.15 360488 Bytes 27/11/2007 11:23:14 AVREG.DLL : 7.0.1.6 30760 Bytes 27/11/2007 11:23:12 AVARKT.DLL : 1.0.0.20 278568 Bytes 27/11/2007 11:23:12 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 27/11/2007 11:23:12 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 27/11/2007 11:23:01 RCTEXT.DLL : 7.0.62.0 86056 Bytes 27/11/2007 11:23:01 SQLITE3.DLL : 3.3.17.1 339968 Bytes 27/11/2007 11:23:12 Configuration settings for the scan: Jobname..........................: Local Drives Configuration file...............: c:\program files\antivir personaledition classic\alldrives.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: E:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mardi 27 novembre 2007 13:58 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 17 processes with 17 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Boot sector 'F:\' [NOTE] In the drive 'F:\' no data medium is inserted! Boot sector 'G:\' [NOTE] In the drive 'G:\' no data medium is inserted! Boot sector 'H:\' [NOTE] In the drive 'H:\' no data medium is inserted! Boot sector 'I:\' [NOTE] In the drive 'I:\' no data medium is inserted! Starting to scan the registry. The registry was scanned ( '16' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'D:\' Begin scan in 'F:\' Search path F:\ could not be opened! Le périphérique n'est pas prêt. Begin scan in 'G:\' Search path G:\ could not be opened! Le périphérique n'est pas prêt. Begin scan in 'H:\' Search path H:\ could not be opened! Le périphérique n'est pas prêt. Begin scan in 'I:\' Search path I:\ could not be opened! Le périphérique n'est pas prêt. Begin scan in 'E:\' Search path E:\ could not be opened! Le périphérique n'est pas prêt. End of the scan: mardi 27 novembre 2007 14:29 Used time: 31:10 min The scan has been done completely. 11806 Scanning directories 206231 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 206231 Files not concerned 1816 Archives were scanned 1 Warnings 14 Notes

colibri29 · Answer

Et enfin le 5ème et dernier scan. J'espère que j ai pas fait des doublons dans mes scan, mieux vaut 2 fois qu'une !!! J'attends tes indications. Merci SCAN SUR MANUAL SELECTION : HP (C:) et RECOVERY (D:) AntiVir PersonalEdition Classic Report file date: mardi 27 novembre 2007 14:47 Scanning for 943200 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows Vista Windows version: (plain) [6.0.6000] Username: karine Computer name: PC-BOURNE Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 27/11/2007 11:23:12 AVSCAN.DLL : 7.0.6.0 49192 Bytes 27/11/2007 11:23:12 LUKE.DLL : 7.0.5.3 147496 Bytes 27/11/2007 11:23:12 LUKERES.DLL : 7.0.6.1 10280 Bytes 27/11/2007 11:23:12 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 11:23:13 ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 11:23:14 ANTIVIR2.VDF : 7.0.1.0 1393152 Bytes 23/11/2007 11:23:14 ANTIVIR3.VDF : 7.0.1.11 38400 Bytes 27/11/2007 11:23:14 AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 27/11/2007 11:23:14 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 27/11/2007 11:23:12 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24 AVPACK32.DLL : 7.3.0.15 360488 Bytes 27/11/2007 11:23:14 AVREG.DLL : 7.0.1.6 30760 Bytes 27/11/2007 11:23:12 AVARKT.DLL : 1.0.0.20 278568 Bytes 27/11/2007 11:23:12 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 27/11/2007 11:23:12 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 27/11/2007 11:23:01 RCTEXT.DLL : 7.0.62.0 86056 Bytes 27/11/2007 11:23:01 SQLITE3.DLL : 3.3.17.1 339968 Bytes 27/11/2007 11:23:12 Configuration settings for the scan: Jobname..........................: Manual Selection Configuration file...............: C:\ProgramData\AntiVir PersonalEdition Classic\PROFILES\folder.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mardi 27 novembre 2007 14:47 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 17 processes with 17 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '16' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: mardi 27 novembre 2007 15:17 Used time: 30:32 min The scan has been done completely. 11806 Scanning directories 206237 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 206237 Files not concerned 1816 Archives were scanned 1 Warnings 14 Notes

jlpjlp · Answer

rien tu as encore des problemes?



Télécharge MSNFix de Laurent 
http://sosvirus.changelog.fr/MSNFix.zip 

Décompresse-le et double clic sur le fichier MSNFix.bat. 
- Exécute l'option R. 
--Si l'infection est détectée, exécute l'option N 
- Sauvegarde ce rapport puis fais un copier/coller de ce rapport sur le forum. 

Note : 
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal 
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement. 


___________

recolle un rapport hiajckthis et surtout dis tes pbs

colibri29 · Answer

j'ai fait la manip MSNfix, rien de detecté.
je t envoi un rapport

je te mets aussi un rapport hyajckthis

A priori plus de problème. J espère ne pas en découvrir d'autre d'ici ce soir.
Au fur et à mesure des manip que tu m'a demandé de faire, mon pc a recommencé à redémarrer + rapidement et lorsque je vais sur internet il ne plante plus, la page web ne reste plus figée sans que je puisse faire quoique ce soit.

Il semble que ce soit enfin ok   :)


Juste pour info, y a pas de problème d'incompatibilité avec tout ce que j'ai installé si je télécharge spywareblaster et kerio ???

-----------------------------------------------

MSNFix 1.592  
 
C:\Users\karine\Desktop\MSNFix\MSNFix 
Fix exécuté le 27/11/2007 - 16:36:38,80 By karine 
mode normal    
    
************************ Recherche les fichiers présents      
    
Aucun Fichier trouvé 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   --------------------------------------------- 
 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:40:59, on 27/11/2007
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\KbdStub.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\ProgramData\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - https://secure.photobox.com/assets/aurigma/ImageUploader4.cab
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

jlpjlp · Answer

tout est bon

tu peux mettre spywareblatster sans pb


pour kerio aussi il faut juste desactiver le parefeu de windows avant de l'installer:  en allant dans ton panneau de configuration puis centre de securité

colibri29 · Answer

Bonjour

j'ai installé spywareblaster. nikel !!!

Par contre je crois que je vais laisser le parefeu windows. 

Kerio et jetico ont l air très bien et efficace mais pas forcément facile à installer et à paramétrer voire carrément casse-pied si mauvais paramétrage. (je me trompe peut être mais j'ai vu beaucoup d'avis de ce type, je sais pas ??? "Dans le doute, abstiens toi")

Mon pc fonctionne à merveille

Je te remercie pour ton aide.
Tu m'as été d'un grand secours face à ces virus sans quoi le pc aurait fini par la fenêtre. La méthode est radicale mais pas forcément efficace...

A+ Colibri29

jlpjlp · Answer

ok

bonne continuation!

Probleme avec navilog (suite trojan+adware)

24 réponses

Discussions similaires

Newsletters