virus ??? Fermé

Question

Bonsoir a tous ! Voila je posséde vista est je crois que j'ai chopper un virus car depuis peut je recoit un message d'alerte de la part d'avast, je clique sur suprimer mais a peut pret une heure aprés le message revient. 
J'ai aussi un petit triangle jaune qui vient s'afficher en bas a droite de mon ecran, comme ceci => http://img395.imageshack.us/img395/2347/81663351ec0.jpg et quand je clique dessu sa m'envoie sur un site qui me propose des anti virus et des logiciel de scan.
J'ai aussi cette fenétre qui s'affiche sans que je fasse quoi que ce soit =>http://img147.imageshack.us/img147/9301/61776248lu6.jpg
Voila donc qu'est ce que je peut faire avec sa ?

Utilisateur anonyme · Answer

Salut quelles sont tous tes logiciel de sécurité ?

ben-j5101 · Answer

J'ai ceci qui s'affiche sans que je fasse quoi que ce soit => http://img211.imageshack.us/img211/4511/57920538nq0.jpg

ben-j5101 · Answer

J'ai seulement installer avast familiale

ben-j5101 · Answer

ok daccord et je laisse faire enssuite ?

ben-j5101 · Answer

Voila j'ai installer ces deux logiciel et je les ai mis a jour, antivir m'as trouver trois fichier dangereuw et j'ai fait "delete"

ben-j5101 · Answer

Voila c'est fait et voila le rapport :

Avira AntiVir Personal
Report file date: mercredi 7 mai 2008  23:10

Scanning for 1255449 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows Vista
Windows version:  (plain)  [6.0.6000]
Boot mode:        Save mode
Username:         Benjamin Lambert
Computer name:    BEN-J

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.4.0       1554432 Bytes  05/05/2008 20:37:08
ANTIVIR3.VDF  : 7.0.4.13        55808 Bytes  07/05/2008 20:37:09
Engineversion : 8.1.0.39  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.28       233851 Bytes  07/05/2008 20:37:39
AESCN.DLL     : 8.1.0.16       119156 Bytes  07/05/2008 20:37:37
AERDL.DLL     : 8.1.0.20       418165 Bytes  07/05/2008 20:37:36
AEPACK.DLL    : 8.1.1.4        364918 Bytes  07/05/2008 20:37:32
AEOFFICE.DLL  : 8.1.0.18       192890 Bytes  07/05/2008 20:37:29
AEHEUR.DLL    : 8.1.0.21      1196407 Bytes  07/05/2008 20:37:27
AEHELP.DLL    : 8.1.0.14       115063 Bytes  07/05/2008 20:37:18
AEGEN.DLL     : 8.1.0.20       299380 Bytes  07/05/2008 20:37:17
AEEMU.DLL     : 8.1.0.6        430451 Bytes  07/05/2008 20:37:14
AECORE.DLL    : 8.1.0.28       168310 Bytes  07/05/2008 20:37:11
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercredi 7 mai 2008  23:10

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
17 processes with 17 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
      [INFO]      Please restart the search with Administrator rights
Master boot sector HD2
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
      [INFO]      Please restart the search with Administrator rights
Master boot sector HD3
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
      [INFO]      Please restart the search with Administrator rights
Master boot sector HD4
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
      [INFO]      Please restart the search with Administrator rights

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'D:\'
      [INFO]      No virus was found!

Starting to scan the registry.
C:\Users\Benjamin Lambert\lsass.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/VB.czs Backdoor server programs
      [NOTE]      The file was deleted!
C:\ProgramData
trxllen\binafori.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\ProgramData\lylgrgva\xkxopgte.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!

The registry was scanned ( '20' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Users\Benjamin Lambert\ctfmon.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/VB.BOI Backdoor server programs
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2DWHN7IH\17PHolmes[1].cmt
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2DWHN7IH\css4[1]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2DWHN7IH\css4[2]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IB8XG4BC\css4[1]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IB8XG4BC\css4[2]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L91A47S2\css4[1]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L91A47S2\css4[2]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L91A47S2\css4[3]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Temp\bx18dxv.dat
      [DETECTION] Contains detection pattern of the dropper DR/Vapsup.eqp
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Temp\byxVLfgf.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Temp\opnnlkIA.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\AppData\Local\Temp\sSmNdefD.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\Users\Benjamin Lambert\Documents\Setup logiciel\webmediaplayer_setup.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'D:\' <HP_RECOVERY>


End of the scan: mercredi 7 mai 2008  23:38
Used time: 28:31 min

The scan has been done completely.

  10296 Scanning directories
 258027 Files were scanned
     17 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     17 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 258010 Files not concerned
   7191 Archives were scanned
      5 Warnings
     17 Notes

Utilisateur anonyme · Answer

Ok bien il a supprimé 17 virus et trojans. Maintenant tu fais un scan en mode sans echec avec Malwarebytes'.

1) Redémarre en "Mode sans échec"

Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8] (ou [F5] sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur [Entrée]
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre.
Regarde ici si besoin : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm

Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut.

2) Scan avec Malwarebyte's Anti-Malware

Lance Malwarebyte's Anti-Malware
Onglet "Recherche" >>> coche Executer un exame complet >>> Rechercher sélectionne tes disques durs puis clique sur Lancer l’examen
A la fin du scan >>> clique sur Afficher les résultats puis sur Enregistrer le rapport
Suppression des éléments détectés >>>> clique sur Supprimer la sélection
S'il t'es demandé de redémarrer >>> clique sur "Yes"

--> Un rapport de scan s'ouvre, enregistre sur ton Bureau et poste ce rapport en réponse.

ben-j5101 · Answer

Avec un peu de retard désolée :
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 28
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\Software\dpcproxy (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\Software\uninstall (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Classes\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\fwbd (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\HolLol (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Inet Delivery (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Invictus (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Golden Palace Casino PT (Trojan.DNSChanger) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv (Fake.Dropped.Malware) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Agent) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\Benjamin Lambert\AppData\Local\Temp	uvTlmJY.dll (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp0000761a (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp00008184 (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp00008935 (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp00008b86 (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp000092ca (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp00009441 (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp0000954a (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp00009654 (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp00009a9a (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp	mp0000b0a2 (Trojan.Vundo) -> No action taken.
C:\Users\Benjamin Lambert\AppData\Local\Temp\pmNHBSMC.dll (Trojan.Agent) -> No action taken.

ben-j5101 · Answer

ouai ouai

ben-j5101 · Answer

J'ai un probléme il me met echec au 2 petite barre de chargement du debut

dou-l · Answer

slt

il a rien supprimer regarde bien :

No action taken.

tout en bas du rapport mbam

dou-l · Answer

Oui alors ne fais pas passer le scan bitdefender si tu ne sais pas demande alors !

ben-j5101 · Answer

Je ne comprend pas désolée, c'est au moment de la mise a jour de bitdefender online scanner, y'a deux barre de chargement, une pour moteur antivirus et l'autre pour signature de virus. Et la sa me met echec pour les deux barre.

dou-l · Answer

1ere fois de quoi ?

dou-l · Answer

je t'ai envoyé un mp

ben-j5101 · Answer

Ok bon ben si c'est pas garve c'est t'en mieu, par contre avast je le reinstal ou je laisse les deux anti virus dont je me suis servis pour faire les scan ?

Utilisateur anonyme · Answer

Non garde que AntiVir et Malwarebytes stp.

ben-j5101 · Answer

daccord ben merci

Virus ???

18 réponses

Discussions similaires

Newsletters