Trojan Onlinegames : impossible à supprimer ?

Résolu
Elea29 -  
 Yammoun -
Bonjour,

Après plusieurs scans d'AVG Anti-Spyware, je n'arrive pas à effacer plusieurs Trojan de type "Onlinegames" avec des extensions différentes ainsi que des Worm. Je les mets en quarantaine, je les supprime et au prochain scan, ils sont encore là...

Je pense faire un HijackThis, je voulais savoir s'il y avait quelqu'un de disponible pour m'aider à l'interpréter et pour me dire les démarches à faire.

Merci !
Configuration: Windows XP
Firefox 2.0.0.14

9 réponses

  1.
    Laurent2709 Messages postés 917 Statut Contributeur 100
     
    Désinstalle ton antivirus et met Antivir depuis ce lien: https://download.cnet.com/Avira-Free-Security-with-Antivirus/3000-18510_4-10322935.html­g=lst-2

    Fais un bon scan, il te trouvera toutes ces crasses

    Dans les options (configuration) :

    Active le mode expert:

    Dans scanner, déroule le menu en appuyant sur +
    Dans Scan, Coche All files dans files, tout dans Additional settings sauf "Ignore files..."
    Déroule en appuyant sur +:

    Dans Archives, coche tout
    Dans heuristic, coche tout et met "high level detection"

    Dans Guard maintenant:
    Appuie sur +:

    Dans heuristic, coche tout et met "high level detection"

    Dans General maintenant:

    Appuie sur le +:

    Dans e-mail: Met l'adresse SMTP du serveur (indisponible dans Hotmail) et ton adresse mail
    Dans extended threats: coche "all files"
    Dans security: Coche tout

    Confirme avec ok

    Voilà, lances le scan depuis la page
    principale. Si un bip retentit et qu'une fenêtre apparait, coches sur "Move to Quarantine"
    Fais ça avec toutes les fenêtres qui vont apparaître

    A la fin du scan, ouvres le rapport en appuyant sur "report" et copie-colle cela
    0
    1. Elea29
       
      Ok merci de vos réponses, je vais suivre ce que vous dites et je vous poste ça..
      0
    2. Elea29
       
      Hello,

      Voila le report d'AntiVir :



      AntiVir PersonalEdition Classic
      Report file date: mardi 22 avril 2008 22:02

      Scanning for 835736 virus strains and unwanted programs.

      Licensed to: Avira AntiVir PersonalEdition Classic
      Serial number: 0000149996-ADJIE-0001
      Platform: Windows XP
      Windows version: (Service Pack 2) [5.1.2600]
      Username: Julien Gensollen
      Computer name: CHEWBACCA

      Version information:
      BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
      AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29
      AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51
      LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47
      LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20
      ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15
      ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:26:55
      ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 13:27:04
      ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 13:27:13
      AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 16:43:56
      AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26
      AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17
      AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24
      AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00
      AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06
      AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33
      AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18
      NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42
      RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13
      RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37
      SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21

      Configuration settings for the scan:
      Jobname..........................: Local Drives
      Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
      Logging..........................: low
      Primary action...................: interactive
      Secondary action.................: ignore
      Scan master boot sector..........: on
      Scan boot sector.................: on
      Boot sectors.....................: F:,
      Scan memory......................: on
      Process scan.....................: on
      Scan registry....................: on
      Search for rootkits..............: on
      Scan all files...................: All files
      Scan archives....................: on
      Recursion depth..................: 20
      Smart extensions.................: on
      Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
      Macro heuristic..................: on
      File heuristic...................: high
      Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

      Start of the scan: mardi 22 avril 2008 22:02

      Starting search for hidden objects.
      '37922' objects were checked, '0' hidden objects were found.

      The scan of running processes will be started
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'firefox.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'hpqgalry.exe' - '1' Module(s) have been scanned
      Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
      Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
      Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
      Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'jusched.exe' - '1' Module(s) have been scanned
      Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
      Scan process 'mixer.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'alg.exe' - '1' Module(s) have been scanned
      Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      32 processes with 32 modules were scanned

      Starting master boot sector scan:
      Master boot sector HD0
      [NOTE] No virus was found!
      Master boot sector HD1
      [NOTE] No virus was found!
      Master boot sector HD2
      [NOTE] No virus was found!

      Start scanning boot sectors:
      Boot sector 'C:\'
      [NOTE] No virus was found!
      Boot sector 'D:\'
      [NOTE] No virus was found!
      Boot sector 'A:\'
      [NOTE] In the drive 'A:\' no data medium is inserted!
      Boot sector 'G:\'
      [NOTE] No virus was found!

      Starting to scan the registry.
      The registry was scanned ( '29' files ).


      Starting the file scan:

      Begin scan in 'C:\' <PITCHOU>
      C:\gy.cmd
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '483c456c.qua'!
      C:\pagefile.sys
      [WARNING] The file could not be opened!
      C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\483c456c.qua
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '4841468a.qua'!
      C:\Documents and Settings\Julien Gensollen\Bureau\Nettoyage\clean\pskill.exe
      [DETECTION] Contains detection pattern of the SPR/Tool.PsKill.2 program
      [INFO] The file was moved to '4879488f.qua'!
      C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\9v.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO] The file was moved to '483c48fa.qua'!
      C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\help.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '487a48ed.qua'!
      C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\psdtohkm.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '4872490b.qua'!
      C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\tru39.tmp
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO] The file was moved to '4883490b.qua'!
      C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\wosrcuy.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '48814908.qua'!
      C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\xk2kzjr.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO] The file was moved to '48404905.qua'!
      C:\Documents and Settings\Julien Gensollen\Local Settings\Temporary Internet Files\Content.IE5\C1EF456V\help[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '487a4904.qua'!
      C:\WINDOWS\system32\amvo0.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING] The file could not be deleted!
      Begin scan in 'D:\' <Houtter II>
      D:\gy.cmd
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '483c5034.qua'!
      Begin scan in 'A:\'
      Search path A:\ could not be opened!
      Le périphérique n'est pas prêt.

      Begin scan in 'G:\' <PHILIPS UFD>
      Begin scan in 'E:\'
      Search path E:\ could not be opened!
      Le périphérique n'est pas prêt.

      Begin scan in 'F:\'
      Search path F:\ could not be opened!
      Le périphérique n'est pas prêt.



      End of the scan: mardi 22 avril 2008 23:07
      Used time: 1:05:13 min

      The scan has been done completely.

      7572 Scanning directories
      407574 Files were scanned
      11 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      11 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
      407563 Files not concerned
      4281 Archives were scanned
      2 Warnings
      0 Notes
      37922 Objects were scanned with rootkit scan
      0 Hidden objects were found
      0
  2. d0ne Messages postés 1019 Statut Membre 73
     
    salut a toi. poste a ton log hijackthis .

    et aussi fait ceci

    Pour supprimer tous ce qui est fichiers temporaires , cookies et autres fichiers inutiles
    téléhcarge CCLEANER sur www.01net.fr puis installe le et coche toutes les cases dnas les 2 onglets .

    pense a cocher desinstalleur de hotfixes .

    voici une image pour illustrer http://img156.imageshack.us/img156/1246/ccleanerza7.jpg tu aura surement + de cases ou moins peut etre mais c'est normal .

    pour défragmenter ton PC je te conseille ce logiciel gratuit. AUSLOGIC DISK DEFRAG

    https://www.clubic.com/telecharger-fiche26672-auslogics-disk-defrag-free.html

    pour faire des SCAN ANTISPYWARE va ici tout est expliqué

    --> http://www.commentcamarche.net/faq/470 spywares

    et ici pour les SCAN ANTIVIRUS

    --> http://www.commentcamarche.net/faq/137 virus
    0
    1. Elea29
       
      Et voila le rapport d'HijackThis :

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 23:51:56, on 22/04/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\Mixer.exe
      C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - D:\Applications\PandoIEPlugin.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programmes ADOBE\Reader\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O17 - HKLM\System\CCS\Services\Tcpip\..\{A28AE16C-C789-4DAB-8457-30A5D715CA1A}: NameServer = 82.216.111.124
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
      O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe
      O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
      0
  3. d0ne Messages postés 1019 Statut Membre 73
     
    donc antivir n'a supprimé aucun virus détecté . je te propose de faire un scan en ligne sur bitdefender.fr

    voici le lien ( il faut le faire en apssant par Internet Explorer car sa ne fonctionne pas sous mozila malheureusement)

    http://www.commentcamarche.net/faq/sujet 8872 scanner en ligne avec bitdefender

    ainsi que celui ci pour etre sûr qu'un nettoyage performant sera effectué.

    http://www.commentcamarche.net/faq/sujet 8873 scanner en ligne avec trendmicro housecall
    0
  4. Laurent2709 Messages postés 917 Statut Contributeur 100
     
    "donc antivir n'a supprimé aucun virus détecté . je te propose de faire un scan en ligne sur bitdefender.fr "

    C'est quoi ça?

    11 viruses and/or unwanted programs were found
    1 Files were classified as suspicious:

    Begin scan in 'C:\' <PITCHOU>
    C:\gy.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was moved to '483c456c.qua'!
    C:\pagefile.sys
    [WARNING] The file could not be opened!
    C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\483c456c.qua
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was moved to '4841468a.qua'!
    C:\Documents and Settings\Julien Gensollen\Bureau\Nettoyage\clean\pskill.exe
    [DETECTION] Contains detection pattern of the SPR/Tool.PsKill.2 program
    [INFO] The file was moved to '4879488f.qua'!
    C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\9v.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '483c48fa.qua'!
    C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\help.exe
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was moved to '487a48ed.qua'!
    C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\psdtohkm.dll
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was moved to '4872490b.qua'!
    C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\tru39.tmp
    [DETECTION] Contains suspicious code HEUR/Crypted
    [INFO] The file was moved to '4883490b.qua'!
    C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\wosrcuy.dll
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was moved to '48814908.qua'!
    C:\Documents and Settings\Julien Gensollen\Local Settings\Temp\xk2kzjr.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '48404905.qua'!
    C:\Documents and Settings\Julien Gensollen\Local Settings\Temporary Internet Files\Content.IE5\C1EF456V\help[1].exe
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was moved to '487a4904.qua'!
    C:\WINDOWS\system32\amvo0.dll
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
    [WARNING] The file could not be deleted!
    Begin scan in 'D:\' <Houtter II>
    D:\gy.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was moved to '483c5034.qua'!
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. d0ne Messages postés 1019 Statut Membre 73
     
    bah je sais pas si t'as compris ce qu'il y a marqué mais les objets ont juste été mis en quarantaine donc pas supprimés.

    et pour moi en quarantaine sa sert a rien . je préfère un fichier supprimé qu'en quarantaine. sans vouloir t'offenser évidemment ^_^
    0
  7. Laurent2709 Messages postés 917 Statut Contributeur 100
     
    La quarantaine est une zone qui bloque les activités des malwares!

    "La quarantaine permet d'empêcher un fichier d'être exécuté ou supprimé, dans le cas d'un malware, cela peut donc l'empêcher d'être actif au sein du système."

    https://www.malekal.com/avira-free-security-antivirus-gratuit/#mozTocId288307
    0
    1. Elea29
       
      Bonjour,

      J'ai fait les scans demandés et nettoyage, j'ai repassé un coup d'AntiVir, quand les Trojan sont en quarantaine, je les supprime ?

      Sinon, petite question, quand il est dit :

      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO] The file was moved to '483c456c.qua'!

      ça veut bien dire que le virus a été déplacé en zone de quarantaine ?

      Il me semble que mon PC a été bien nettoyé, je crois que je vais garder AntiVir ^^ ! Y a-t-il d'autres choses à faire , Sinon, je vous remercie !
      0
  8. d0ne Messages postés 1019 Statut Membre 73
     
    autant pour moi laurent2709 , c'est jute mon point de vue. je m'excuse.
    c'est juste que je préfère savoir un virus supprimé qu'en quarantaine.

    @Elea29 : oui garde antivir c'est un tres bon antivirus .

    0
  9. Laurent2709 Messages postés 917 Statut Contributeur 100
     
    Pas de problème Done, merci pour ta participation!

    Encore un problème réglé par Antivir!
    0

Discussions similaires

Aide pour un virus
cerise92700 -
MisteryBean -

41 réponses
Trojan impossible à supprimer!
Gridouu -
Malekal_morte- -

12 réponses
Comment supprimer le virus Trojan
vitsou -
vitsou -

18 réponses
Menace détectée TrojanSMS-PA sur Google Huawei/Android
Outmost -
bazfile -

6 réponses
Que pensez-vous de Trojan Remover ?
patmoss -
DOUBLON -

10 réponses