Debutant besoin d aide pour formatage pc

Question

Bonjour a tous , je suis un jeune homme de 16 ans ayant un peu d expérience informatique mais pas une connaissance immense , je possède un pc portable Dell Latitude D610 , voila mon problème je me retrouve confronté a un virus qui me dérègle l heure et la date de mon pc et il n y a pas moyen de la faire disparaitre , mis a part ça c est quand même la guerre entre avast et tout le reste de mon pc , j en ai donc marre et j aimerais formater mon pc mais je ne possède plus le cd windows mais ma clé est originale ( étiquette placé sous le pc ) 
--> Les logiciels windows que je pourrais trouver sur des sites tels que emule-island ou autre sont t-ils sans risques ? 
--> Lors du formatage du mon pc , dois je faire attention a quelque chose ? et a part les drivers de mon pc dois-je préparer autre chose ?
--> Pour mes drivers j avais prévu de les compresser et des les mettre dans mon disque dur externe ou graver un cd avec ceux ci a partir de ma tour qui se trouve dans ma chambre , dois-je suivre une manœuvre bien précise ou un ordre bien précis pour les installer ? 

Je vous demande cela car je n ai pas vraiment l argent pour un informaticien , et je me suis dit que peut être a partir de ce forum on pourrais me guider , si vous pourriez ce serait très gentil de votre part et je vous en remercie d avance 

PS: Si j'aurais oublié un détail , pourriez vous me l indiquez , malgré que je suis en période d examens je viendrais assez souvent voir si j ai des questions

Bien a vous 
michael

Utilisateur anonyme · Answer

Salut pourquoi veux tu reformater ?

linkarwen · Answer

salut,
desinstalle avast,c'est pas un bon antivirus,il se met a jour des virus souvent quelque semaine apres que le virus est en circulation
installe antivir bien meilleur antivirus est vraiment efficace lors du premier scan
voici son tutoriel pour t'aider
bon courag;)

michael007 · Answer

Pour boy94450

Ben c est la guerre avec mes virus , j en ai un qui s exécute lui même au démarrage de windows dérègle tout le temps la date et l heure de mon pc , mon internet est quasi inexistant , je ne sais même plus utiliser msn , j ai des chevaux de troie , donc voila je voudrais faire un bon ménage complet 

Pour linkarwen 

ok je vais voir , il y a t-il une clé a obtenir ou es ce gratuit , attention mon pc dois avoir une cheval de troie caché , je possede aussi ccleaner mais cela n arrange rien

linkarwen · Answer

oui antivir est gratuit est assez simple d'utilisation et ensuite fais comme comme boy94450 te la  demandé.
sa ira beaucoup mieux apres.

michael007 · Answer

D accord je vais faire tout ça et je vous tiens au courant , vraiment merci beaucoup en tout cas

michael007 · Answer

J ai oublié de vous signaler un détail peut être important , c est que certain de mes fichier ont été infectés et ont ete convertis en cheval de troie comme le fichier run32dll.exe je crois , j ai essayé de les réparer mais cela ne fonctionnais pas et j ai fait la même manœuvre pour certains fichier qui se trouvaient souvent dans le dossier system32 dans windows , je n ai toujours pas eu de problème de système si ce n est que quand je veux eteindre le pc je dois attendre car il n arrive pas a mettre fin au programme run32dll.exe ( que j ai supprimé ) et cette fenêtre apparait 2 fois , avant que mon pc puisse s éteindre

michael007 · Answer

je vais le faire maintenant car j utilisait windows en mode sans échec , car c est la bazar total en mode normal

michael007 · Answer

es ce normal que l installation de antivir puise durer aussi longtemps ?

linkarwen · Answer

comme on dit plus c'est long,plus c'est bon.
etape par etapes,tanquillement sans stresser,tout ce passera bien

michael007 · Answer

voila antivir , kerio et malwarebytes sont installés , je n ai pas lancé d analyse , je vais faire la mise a jour pour anti vir , et configurer kerio comme demandé dans le tutoriel , apres je dois redemarrer mon ordi en mode sans echec ?

linkarwen · Answer

fais la mise a jour d'antivir et balance un scan apres.
a tout les coup il va te detecter pas mal de saletés.
et ensuite utilise les autres programmes

michael007 · Answer

ok , je fais ça immédiatement

michael007 · Answer

Il y a un probleme , j ai redemarré mon ordi et directement il m a trouve un cheval de troie au demarrage et je ne pouvais plus rien faire , il avait un tuuut a chaque mouvement de souris , je suis passé en mode sans echec mais je ne peux pas faire la mise a jour , ques que je fais ?

linkarwen · Answer

ton cheval de troie es detecté par antivir?
met le en quarantaine ou choisi delete directement

michael007 · Answer

oui par antivir , ok je vais redemarrer et faire ca

linkarwen · Answer

des que tu redemarre,fais direct un scan avec antivir.
tu le laisse terminé et tu n'as qu'a valider quand il te detecte un cheval de troies.a mon avis tu en as une paires,bon courage

michael007 · Answer

oui deja 2 au demarrage , je vais etudier en attendant et je reviendrais en fin de journee vous donner l etat de la situation , merci encore

linkarwen · Answer

la au moin c'est un poste bien mieux detaillé,au loins on ne peux pas se trompé.
bien joué boy ;)

michael007 · Answer

Bonsoir , désole pour le retard , l analyse s est passé a merveille , cependant j ai fait ca en mode sans echec mais sur la session administrateur et les virus ( dont 33 chevaux de troie ) ont ete placés en quarantaine je n avais pas vu les 2 derniers posts , l analyse de malware s est coupée soudainement donc je la recommencerais demain matin et je dois encore configurer kerio , en tout cas encore un grand merci a vous , bonne soirée 

voici le resumé du rapport ( car cela fait 2 fois que j essaye de poster sans resultats ) 

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Save mode
Username:         Administrateur
Computer name:    DRIVEN-HNAH19ZY

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.4.120     2206720 Bytes  01/06/2008 11:52:09
ANTIVIR3.VDF  : 7.0.4.156      144896 Bytes  06/06/2008 11:52:10
Engineversion : 8.1.0.55  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.40       266618 Bytes  07/06/2008 11:52:21
AESCN.DLL     : 8.1.0.21       119156 Bytes  07/06/2008 11:52:20
AERDL.DLL     : 8.1.0.20       418165 Bytes  07/06/2008 11:52:19
AEPACK.DLL    : 8.1.1.5        364918 Bytes  07/06/2008 11:52:18
AEOFFICE.DLL  : 8.1.0.18       192890 Bytes  07/06/2008 11:52:17
AEHEUR.DLL    : 8.1.0.30      1253750 Bytes  07/06/2008 11:52:17
AEHELP.DLL    : 8.1.0.15       115063 Bytes  07/06/2008 11:52:14
AEGEN.DLL     : 8.1.0.28       307572 Bytes  07/06/2008 11:52:13
AEEMU.DLL     : 8.1.0.6        430451 Bytes  07/06/2008 11:52:12
AECORE.DLL    : 8.1.0.31       168310 Bytes  07/06/2008 11:52:11
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, F:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: samedi 7 juin 2008  14:13

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
12 processes with 12 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'F:\'
      [INFO]      No virus was found!

Starting to scan the registry.
C:\WINDOWS\system32\Fixer.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48c27bd5.qua'!
C:\WINDOWS\system32\jvfnez.exe
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '48b07be6.qua'!
C:\WINDOWS\system32\afuoqsxa.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48bf7be2.qua'!
C:\WINDOWS\winudpmgr.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [NOTE]      DR/Delphi.Gen:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]:<Windows UDP Control Center>=sz:winudpmgr.exe
      [NOTE]      The file was moved to '48b87beb.qua'!
C:\WINDOWS\system32\start0s.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48ab7c08.qua'!
C:\WINDOWS\system32\yyspjbw.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was moved to '48bd7c5d.qua'!
C:\WINDOWS\system32\filename.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48b67c53.qua'!

The registry was scanned ( '51' files ).

michael007 · Answer

et la suite 
Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\DeleteTemp.exe
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\dlmgr.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\GenComp.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\HtmlLite.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\Setup.EXE
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1025.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1028.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1029.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1030.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1031.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1032.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1035.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1036.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1037.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1038.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1040.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1041.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1042.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1043.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1044.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1045.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1046.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1049.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1053.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.1055.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.2052.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.2070.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.3082.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\setupres.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\SitSetup.DLL
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\VS70UIMgr.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\VSBaseReqs.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\VSScenario.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\VS_Setup.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1025.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1028.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1029.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1030.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1031.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1032.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1035.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1036.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1037.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1038.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1040.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1041.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1042.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1043.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1044.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1045.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1046.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1049.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1053.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.1055.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.2052.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.2070.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.3082.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapRes.dll
      [WARNING]   The file could not be opened!
C:\2c40a61b347782ea9560ec1856\WapUI.dll
      [WARNING]   The file could not be opened!
C:\Documents and Settings\driven\ASDASSS.EXE
      [DETECTION] Contains detection pattern of the HTML script virus HTML/NetCarto.6913
      [NOTE]      The file was moved to '488e7d5b.qua'!
C:\Documents and Settings\driven\djdhd3d2ghd.exe
      [DETECTION] Contains detection pattern of the HTML script virus HTML/NetCarto.6913
      [NOTE]      The file was moved to '48ae7d78.qua'!
C:\Documents and Settings\driven\djdhd3fd2ghd.exe
      [DETECTION] Contains detection pattern of the HTML script virus HTML/NetCarto.6913
      [NOTE]      The file was moved to '48ae7d7f.qua'!
C:\Documents and Settings\driven\djukeoldw.exe
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '48bf7d82.qua'!
C:\Documents and Settings\driven\goodluck.EXE
      [DETECTION] Contains detection pattern of the HTML script virus HTML/NetCarto.6913
      [NOTE]      The file was moved to '48b97d8c.qua'!
C:\Documents and Settings\driven\hdjuilsik.exe
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '48b47d84.qua'!
C:\Documents and Settings\driven\SDASSS.EXE
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '488b7d71.qua'!
C:\Documents and Settings\driven\xwedeoldb.exe
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '48af7dac.qua'!
C:\Documents and Settings\driven\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\71YMWHM4\www.Shakira_Fucked_in_Japan[1].com
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '48c17f07.qua'!
C:\Documents and Settings\driven\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\FFZSU1GK\www.Shakira_Fucked_in_Japan[1].com
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '48c17f14.qua'!
C:\Documents and Settings\driven\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\WHEKK2QM\www.Britney_spears_Fucked_in_Japan[1].com
      [DETECTION] Is the Trojan horse TR/Drop.LdPinch.AC.46
      [NOTE]      The file was moved to '48c17f21.qua'!
C:\Documents and Settings\driven\Local Settings\Temporary Internet Files\Content.IE5\3HX9HGN9\dir[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48bc7f23.qua'!
C:\Documents and Settings\driven\Local Settings\Temporary Internet Files\Content.IE5\XHAQO6QH\F[1].EXE
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was moved to '487b7f2c.qua'!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0YFUHO8U
1n[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48b88026.qua'!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\2DWX8KDB
1n[2].exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48b8802e.qua'!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\7VKBGX25edora[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48ae8068.qua'!
C:\Program Files\eMule\Incoming\Ashampoo.ClipFisher.v1.0.8.Incl-Keygen.[emule-island.com].rar
  [0] Archive type: RAR
  --> Keygen\keygen.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48b281eb.qua'!
C:\Program Files\My Apps\cumd.ocx
      [DETECTION] Contains detection pattern of the IRC virus IRC/BackDoor.Zapc.A
      [NOTE]      The file was moved to '48b78362.qua'!
C:\WINDOWS\cumdx.hlp
      [DETECTION] Contains detection pattern of the IRC virus IRC/BackDoor.Zapc.A
      [NOTE]      The file was moved to '48b78604.qua'!
C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\colbact.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\comuid.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\es.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$\ole32.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$pcrt4.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$pcss.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB828741$	xflog.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\browser.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\callcont.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\evtgprov.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\msgina.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\mst120.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$
etapi32.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$
mcom.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$tcdll.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\schannel.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\aowgegpm.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [NOTE]      The file was moved to '48c18a19.qua'!
C:\WINDOWS\system32\asdassd.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [NOTE]      The file was moved to '48ae8a22.qua'!
C:\WINDOWS\system32\crspxvp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48bd8a40.qua'!
C:\WINDOWS\system32\ddsp.exe
      [DETECTION] Contains detection pattern of the dropper DR/Kolab.SF
      [NOTE]      The file was moved to '48bd8a41.qua'!
C:\WINDOWS\system32\f1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48788a27.qua'!
C:\WINDOWS\system32\hhyt.exe
      [DETECTION] Contains detection pattern of the dropper DR/Kolab.SF
      [NOTE]      The file was moved to '48c38a6b.qua'!
C:\WINDOWS\system32\mfxypt.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48c28a90.qua'!
C:\WINDOWS\system32
1n.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48b88a96.qua'!
C:\WINDOWS\system32\pdtytc.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48be8ae0.qua'!
C:\WINDOWS\system32\qpufgs.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48bf8afa.qua'!
C:\WINDOWS\system32edora.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48ae8af9.qua'!
C:\WINDOWS\system32\RegFax.dll
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48b18afe.qua'!
C:\WINDOWS\system32pofnobq.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48b98b14.qua'!
C:\WINDOWS\system32\vbpbvw.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48ba8b29.qua'!
C:\WINDOWS\system32\vceqlr.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48af8b30.qua'!
C:\WINDOWS\system32\WinTcpip.exe
      [DETECTION] Is the Trojan horse TR/Agent.DFL
      [NOTE]      The file was moved to '48b88b4a.qua'!
C:\WINDOWS\system32\xriypl.exe
      [DETECTION] Is the Trojan horse TR/Crypt.TPM.Gen
      [NOTE]      The file was moved to '48b38b6c.qua'!
C:\WINDOWS\system32\xtt.exe
      [DETECTION] Contains detection pattern of the worm WORM/IrcBot.620544
      [NOTE]      The file was moved to '48be8b73.qua'!
C:\WINDOWS\system32\yuvwja.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48c08b7b.qua'!
C:\WINDOWS\system32\dllcache\shvhost.exe
      [DETECTION] Contains detection pattern of the worm WORM/VanBot.OZ
      [NOTE]      The file was moved to '48c08bd0.qua'!
C:\WINDOWS\system32\dllcache\wintcps.exe
      [DETECTION] Contains detection pattern of the worm WORM/SdBot.397312.28
      [NOTE]      The file was moved to '48b88be4.qua'!
C:\WINDOWS\Visualtooltip\imds.hlp
      [DETECTION] Contains detection pattern of the IRC virus IRC/BackDoor.Zapc.A
      [NOTE]      The file was moved to '48ae8c2a.qua'!
Begin scan in 'F:\'


End of the scan: samedi 7 juin 2008  15:25
Used time:  1:12:52 min

The scan has been done completely.

   4923 Scanning directories
 189737 Files were scanned
     48 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     48 files were moved to quarantine
      0 files were renamed
     97 Files cannot be scanned
 189689 Files not concerned
   1677 Archives were scanned
     97 Warnings
     48 Notes

michael007 · Answer

voila c est fait merci beaucoup , je vais considérer ce problème comme résolu

michael007 · Answer

ha bon desole je croyais , que manque t il ?

michael007 · Answer

ok , je ne prend pas le mode sans échec avec réseau pris en charge ?

michael007 · Answer

ok je reviendrais en apres midi poster les resultats

michael007 · Answer

re , pour la 2 ème fois l analyse a soudainement été stoppée , mentionnant le message : run-time error <<9>> , l analyse a été faite en mode sans échec et dans la session maison

michael007 · Answer

mais j ai quelque chose a proposer , il me trouve un malware très tôt dans l analyse et je crois que c est le seul , ce que je peux faire c est des qu il a trouvé le malware au début c est de stopper l analyse , voir le résultat et le poster

michael007 · Answer

Comme c est la dernière fois que je me connecte avant demain après midi j ai quand même fait comme je vous l ai proposé au dessus et voila le rapport : 

Malwarebytes' Anti-Malware 1.15
Version de la base de données: 837

17:49:41 08/06/2008
mbam-log-6-8-2008 (17-49-25).txt

Type de recherche: Examen complet (C:\|F:\|)
Eléments examinés: 5323
Temps écoulé: 3 minute(s), 49 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

michael007 · Answer

Voila , cela vient d être fait , que dois-je faire ensuite ?

michael007 · Answer

j ai un nouveau rapport pour malwarebytes le voici : 

Malwarebytes' Anti-Malware 1.15
Version de la base de données: 837

16:08:56 10/06/2008
mbam-log-6-10-2008 (16-08-56).txt

Type de recherche: Examen complet (F:\|)
Eléments examinés: 22521
Temps écoulé: 12 minute(s), 20 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service Agent (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSN (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Windows LoL Layer (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows LoL Layer (Worm.Sdbot) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\wkssvr.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

Debutant besoin d aide pour formatage pc

29 réponses

Votre réponse

Newsletters