help braviax et barre de tache qui disparait Résolu

Question

Bonjour,
Je suis contaminé par braviax, j'ai en plus une nouveauté, ma barre de tache et tout mes inconne disparaissent dès que l'anti virus (avast) et mon spybot détecte le cheval de troie, ducoup je peux plus rien faire (il fat que je me connecte très vite sinon c'est fini.
Quelqu'un peut-il m'aider, je peux plus rien faire avec mon ordi

Merci d'avance

Ps (je suis vraiment pas un expert en informatique

fiat500 · Answer

salut

Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

fiat500 · Answer

http://pon.fr/dr-web-cure-it-kit-de-desinfection-gratuit/

ty30 · Answer

j'execute l'antivirus de ton lien, mais au bout de quelque minute je recoi un message d'erreur et je suis obligé de tout couper

fiat500 · Answer

essais en mode sans echec

fiat500 · Answer

ok

télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

* Double-clique dessus pour lancer l'installation
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré (C:\lopR.txt)
---

fiat500 · Answer

télécharge hijackthis fais un scan et colle moi le log ici

http://www.infos-du-net.com/telecharger/HijackThis,0301-454.html

tuto hijackthis:

https://forums.cnetfrance.fr

fiat500 · Answer

désinstalle avast puis mes antivir mes le a jour puis lance un scan et supprime tous se qu'il trouve (delete)

aide antivir :

https://www.malekal.com/avira-free-security-antivirus-gratuit/

Réglages pour AntiVir:

*Ouvre "AntiVir" puis clique sur "Configuration" et coche la case "Expert Mode" puis sur l´onglet "Scanner" dans la fenêtre du dessous tu va voir:
*Vas dans l'onglet "Scanner" puis coche "All Files" et en dessous dans l'onglet "Scanner Priority" tu mets "High".
*Puis toujours dans l'onglet "Scanner" dans l'encadrer "Scan proces" coche "Allow stopping the scanner"cela te permettra de faire une pause pendant l' analyse si tu le souhaite.

*Puis toujours dans l'onglet "Scanner" dans l'encadre "Additionnal Setting" coches ces lignes:

*"Scan boot sectors of selected drives"
*"Scan master boot sectors"
*"Scan memory"
*"Search foe rootkit before scan"

Et maintenant décoche:

*"Ignore off line files"

*Puis dans l'onglet "Scanner" vas dans le sous-onglet "Scan" puis "Heurestic" puis coche "Macrovirus Heuristic" puis coche "Win32 flie heuristic" puis sur "High detection level"
"
*Puis aussi clique sur l'onglet "Guard" puis coche "Scan archive" puis tu décoche les 3 case en dessous puis "Ok"

ty30 · Answer

J'ai voulu télécharger antivir, je me retrouve avec "AVIRA Antivir Personal" c'est bien celui la?

fiat500 · Answer

oui c'est celui que je t'ai dit de telecharger!

ty30 · Answer

Voila le rapport de antivir, est-ce que c'est bon ?


Avira AntiVir Personal
Report file date: samedi 31 mai 2008  16:33

Scanning for 1165085 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    FOUCRAS-572D3FA

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.62       337408 Bytes  21/03/2008 19:12:34
ANTIVIR3.VDF  : 7.0.3.68        57856 Bytes  25/03/2008 08:27:50
Engineversion : 8.1.0.28  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.19       229754 Bytes  07/04/2008 15:34:44
AESCN.DLL     : 8.1.0.12       115060 Bytes  07/04/2008 15:34:44
AERDL.DLL     : 8.1.0.19       418164 Bytes  07/04/2008 15:34:44
AEPACK.DLL    : 8.1.1.0        364918 Bytes  18/03/2008 11:20:42
AEOFFICE.DLL  : 8.1.0.15       192889 Bytes  07/04/2008 15:34:44
AEHEUR.DLL    : 8.1.0.15      1147253 Bytes  07/04/2008 15:34:44
AEHELP.DLL    : 8.1.0.11       115061 Bytes  07/04/2008 15:34:43
AEGEN.DLL     : 8.1.0.15       299379 Bytes  07/04/2008 15:34:43
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.25       168309 Bytes  08/04/2008 09:58:32
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, F:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: samedi 31 mai 2008  16:33

Starting search for hidden objects.
Error in ARK lib

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'ServiceLayer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'slserv.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'remoterm.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'NSLauncher.exe' - '1' Module(s) have been scanned
Scan process 'sclauncher.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'CplBCL50.EXE' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
42 processes with 42 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
Master boot sector HD2
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'F:\'
      [INFO]      No virus was found!

Starting to scan the registry.
C:\WINDOWS\system32\braviax.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage	uoy.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!

The registry was scanned ( '30' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\VarioRougeAntiSpy2.zip
      [DETECTION] Contains suspicious code GEN/PwdZIP
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '48b362d2.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\VRP8K025\RestorWIN[1].zip
  [0] Archive type: ZIP
    --> RestorWIN/RestorWIN.exe
          [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was deleted!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\VRP8K025\RestorWIN[1]\RestorWIN\RestorWIN.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was deleted!
C:\Documents and Settings\Tony\Local Settings\Temporary Internet Files\Content.IE5\GB1RLZU3\WebResource[4].axd
      [DETECTION] Contains detection pattern of the Java script virus JS/Agent.6300
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0040729.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0040746.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0041747.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0041762.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0041777.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0042771.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044826.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044880.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044911.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044949.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044963.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044996.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0047038.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0048051.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049266.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP94\A0049280.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP94\A0049281.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP94\A0049282.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was deleted!
C:\WINDOWS\braviax.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
Begin scan in 'F:\' <TONY>


End of the scan: samedi 31 mai 2008  19:49
Used time:  3:16:30 min

The scan has been done completely.

   7541 Scanning directories
 318788 Files were scanned
     21 viruses and/or unwanted programs were found
      4 Files were classified as suspicious:
     24 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 318767 Files not concerned
  18735 Archives were scanned
      2 Warnings
     25 Notes
  32531 Objects were scanned with rootkit scan
      0 Hidden objects were found

fiat500 · Answer

re bonjour poste moi un nouveau log hijackthis

ty30 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 15:04:23, on 01/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\EzButton\CplBCL50.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Propriétaire.FOUCRAS-572D3FA\Bureau\Protection\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CplBCL50] C:\Program Files\EzButton\CplBCL50.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sclauncher] C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

fiat500 · Answer

tu na plus rien d'apres le rapport

fais un scan en ligne avec Internet Explorer stp:

BitDefender en ligne: http://www.bitdefender.fr/scan_fr/scan8/ie.html
Tutoriel BitDefender en ligne: http://cybersecurite.xooit.com/t201-Scan-en-ligne-BitDefender.htm

ty30 · Answer

C'est super, merci beaucoup pour ton aide, je n'aurai jamais pu m'en sortir seul. 
Voila le rapport que tu m'a demander, deux dernieres question tout de meme, tu m'a fait désinstaller avast dois-je le réinstaller ? et quelle protection anti virus et anti spywere tu me conseillerai ?

Voie d'analyse: C:\;D:\;E:\;F:\;
  
  
 
 
Statistiques
 
Temps
 00:46:55
 
Fichiers
 71478
 
Directoires
 7563
 
Secteurs de boot
 2
 
Archives
 1234
 
Paquets programmes
 4946
 
  
  
 
Résultats
 
Virus identifiés
 4
 
Fichiers infectés
 19
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 19
 
  
  
 
Info sur les moteurs
 
Définition virus
 1255510
 
Version des moteurs
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Analyse des plugins
 16
 
Archive des plugins
 42
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 5
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Documents and Settings\Propriétaire.FOUCRAS-572D3FA\Local Settings\Temporary Internet Files\Content.IE5\K5UB4DUH\Install[1].exe
 Infecté par: Trojan.Generic.274443
 
C:\Documents and Settings\Propriétaire.FOUCRAS-572D3FA\Local Settings\Temporary Internet Files\Content.IE5\K5UB4DUH\Install[1].exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0043823.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP92\A0043823.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044889.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044889.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044929.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044929.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044979.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0044979.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0045017.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0045017.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0046020.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0046020.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0047020.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0047020.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0047054.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0047054.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0048070.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0048070.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049072.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049072.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049127.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049127.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049271.sys
 Infecté par: Rootkit.Agent.XK
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049271.sys
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049278.exe
 Infecté par: Trojan.Generic.274443
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP93\A0049278.exe
 Supprimé
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP94\A0049283.exe
 Infecté par: Trojan.Crypt.DR
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP94\A0049283.exe
 Echec de la désinfection
 
C:\System Volume Information\_restore{5DFF049F-AB92-465D-AE37-7CF984C54E3D}\RP94\A0049283.exe
 Supprimé
 
C:\WINDOWS\system32\dllcache\beep.sys
 Infecté par: Rootkit.Agent.XK
 
C:\WINDOWS\system32\dllcache\beep.sys
 Supprimé
 
C:\WINDOWS\system32\drivers\beep.sys
 Infecté par: Rootkit.Agent.XK
 
C:\WINDOWS\system32\drivers\beep.sys
 Supprimé
 
C:\WINDOWS\system32\univrs32.dat
 Infecté par: Trojan.Downloader.Agent.ZAK
 
C:\WINDOWS\system32\univrs32.dat
 Supprimé
 
C:\WINDOWS\system32\winivstr.exe
 Infecté par: Trojan.Generic.274443
 
C:\WINDOWS\system32\winivstr.exe
 Supprimé

fiat500 · Answer

tu peut mettre résolue

fiat500 · Answer

derien
a+
merci

Help braviax et barre de tache qui disparait

16 réponses

Discussions similaires

Newsletters