mariafromgreece
Messages postés3Date d'inscriptionvendredi 18 juillet 2008StatutMembreDernière intervention19 novembre 2008
-
18 juil. 2008 à 23:48
mariafromgreece
Messages postés3Date d'inscriptionvendredi 18 juillet 2008StatutMembreDernière intervention19 novembre 2008
-
19 juil. 2008 à 10:54
Bonsoir,
je viens de m'inscrire,j'ai decouvert ce site par hazard!!!Deja je tiens a dire que je suis pas une pro des ordi mais jme debrouille bien...
J'ai telecharge Avira Antivir,qui est tres bien,j'ai scanne mon pc et voila mon rapport...que evidement je ne comprends rien.J'ai compris que j'ai des virus Trojan,mais ctout!Je fais quoi pour les supprimer (tous)?????
Voila le rapport:
Avira AntiVir Personal
Report file date: Παρασκευή, 18 Ιουλίου 2008 23:31
Scanning for 1475814 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: MARIA
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: Παρασκευή, 18 Ιουλίου 2008 23:31
Starting search for hidden objects.
c:\windows\prefetch\ymywkkw.exe-202cfb49.pf
[INFO] The file is not visible.
[NOTE] A backup was created as '48f9fee1.qua' ( QUARANTINE )
c:\documents and settings\ΤΕΟ ΒΛΑΧΑ\local settings\application data\ymywkkw.dat
[INFO] The file is not visible.
[NOTE] A backup was created as '4b20f93a.qua' ( QUARANTINE )
c:\documents and settings\ΤΕΟ ΒΛΑΧΑ\local settings\application data\ymywkkw.exe
[INFO] The file is not visible.
[NOTE] A backup was created as '4b22d172.qua' ( QUARANTINE )
[INFO] ymywkkw.exe
[INFO] The process is not visible.
c:\documents and settings\ΤΕΟ ΒΛΑΧΑ\local settings\application data\ymywkkw_nav.dat
[INFO] The file is not visible.
[NOTE] A backup was created as '4b24a9aa.qua' ( QUARANTINE )
c:\documents and settings\ΤΕΟ ΒΛΑΧΑ\local settings\application data\ymywkkw_navps.dat
[INFO] The file is not visible.
[NOTE] A backup was created as '4b2681e2.qua' ( QUARANTINE )
'45764' objects were checked, '6' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'NkbMonitor.exe' - '1' Module(s) have been scanned
Scan process 'ServiceLayer.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmon.exe' - '1' Module(s) have been scanned
Scan process 'MessengerSkinner.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'LaunchApplication.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmgr.exe' - '1' Module(s) have been scanned
Scan process 'BWPRNMON.EXE' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned
Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'fxssvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '62' files ).
Starting the file scan:
Begin scan in 'C:\' <SYSTEM>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\SpywareSecure_trial_setup.exe
[DETECTION] Is the TR/FakeAV.BA Trojan
[NOTE] The file was deleted!
C:\AddOn\MSWORKS\REDIST\IE6\TEMPFILE.CAB
[0] Archive type: CAB (Microsoft)
--> msoe.hlp
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Documents and Settings\ΤΕΟ ΒΛΑΧΑ\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7d90eba7-709e933e.zip
[0] Archive type: ZIP
--> BlackBox.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.2 Java virus
--> VerifierBug.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.4 Java virus
--> Dummy.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.3 Java virus
--> Beyond.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.1 Java virus
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.2 Java virus
[NOTE] The file was moved to '48f6008e.qua'!
C:\Documents and Settings\ΤΕΟ ΒΛΑΧΑ\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-c2ba1c5-581869d2.zip
[0] Archive type: ZIP
--> BlackBox.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.2 Java virus
--> VerifierBug.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.4 Java virus
--> Dummy.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.3 Java virus
--> Beyond.class
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.1 Java virus
[DETECTION] Contains recognition pattern of the JAVA/BlackBox.AA.2 Java virus
[NOTE] The file was moved to '48f60094.qua'!
C:\Documents and Settings\ΤΕΟ ΒΛΑΧΑ\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-8fba448-281d81cc.zip
[0] Archive type: ZIP
--> GetAccess.class
[DETECTION] Contains recognition pattern of the JAVA/OpenConnect.AJ Java virus
--> Installer.class
[DETECTION] Contains recognition pattern of the JAVA/OpenConnect.AK Java virus
--> NewSecurityClassLoader.class
[DETECTION] Contains recognition pattern of the JAVA/ByteVerify.G.2 Java virus
--> NewURLClassLoader.class
[DETECTION] Contains recognition pattern of the JAVA/ByteVerify.G.3 Java virus
[DETECTION] Contains recognition pattern of the JAVA/OpenConnect.AJ Java virus
[NOTE] The file was moved to '48f7008c.qua'!
C:\Documents and Settings\ΤΕΟ ΒΛΑΧΑ\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv494.jar-2161aa35-5fd1fdb4.zip
[0] Archive type: ZIP
--> Matrix.class
[DETECTION] Contains recognition pattern of the JAVA/Beyond.D3 Java virus
--> Counter.class
[DETECTION] Contains recognition pattern of the JS/OpenConnect.J.1 Java script virus
--> Dummy.class
[DETECTION] Is the TR/Forten.Java.2 Trojan
--> Parser.class
[DETECTION] Contains recognition pattern of the JS/OpenConnect.J.3 Java script virus
[DETECTION] Contains recognition pattern of the JAVA/Beyond.D3 Java virus
[NOTE] The file was moved to '48e200a2.qua'!
C:\Documents and Settings\ΤΕΟ ΒΛΑΧΑ\Local Settings\Application Data\Microsoft\Internet Explorer\V0.39.dat
[DETECTION] Is the TR/Dldr.Small.bea Trojan
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26003
[WARNING] The file could not be deleted!
[NOTE] Attempting to perform action using the ARK lib.
[NOTE] The file was moved to '4f02e2ed.qua'!
C:\Documents and Settings\ΤΕΟ ΒΛΑΧΑ\Local Settings\Temp\temp.dll
[DETECTION] Is the TR/Agent.247296 Trojan
[NOTE] The file was moved to '48ee00cb.qua'!
C:\Documents and Settings\ΤΕΟ ΒΛΑΧΑ\Local Settings\Temp\zfe2.exe
--> Object
[1] Archive type: RSRC
--> Object
[DETECTION] Is the TR/Zlob.10240.C Trojan
--> Object
[DETECTION] Is the TR/Dldr.Zlob.ldk.1 Trojan
[NOTE] The file was moved to '48e600f3.qua'!
C:\System Volume Information\_restore{65A46257-4EA0-4BF0-A43E-3F6D2B904589}\RP214\A0049121.exe
[DETECTION] Contains recognition pattern of the DR/Toolbar.404Search.H dropper
[NOTE] The file was deleted!
C:\System Volume Information\_restore{65A46257-4EA0-4BF0-A43E-3F6D2B904589}\RP217\A0055447.exe
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '48b1076d.qua'!
C:\System Volume Information\_restore{65A46257-4EA0-4BF0-A43E-3F6D2B904589}\RP229\A0060150.dll
[DETECTION] Is the TR/Agent.247296 Trojan
[NOTE] The file was moved to '48b107bf.qua'!
C:\System Volume Information\_restore{65A46257-4EA0-4BF0-A43E-3F6D2B904589}\RP229\A0060259.exe
[DETECTION] Is the TR/FakeAV.BA Trojan
[NOTE] The file was moved to '48b107cb.qua'!
C:\WINDOWS\SoftwareDistribution\Download\d100bbadacc6f340ceca4b7e8bbadff3\BIT21.tmp
[0] Archive type: CAB (Microsoft)
--> amd64\s117cmnt.sys
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\WINDOWS\system32\MSA64CHK.dll
[DETECTION] Is the TR/Dldr.Perfiler.G Trojan
[NOTE] The file was moved to '48c20b2f.qua'!
End of the scan: Σάββατο, 19 Ιουλίου 2008 00:32
Used time: 1:00:35 Hour(s)
The scan has been done completely.
3614 Scanning directories
286557 Files were scanned
29 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
2 files were deleted
0 files were repaired
16 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
286525 Files not concerned
7444 Archives were scanned
5 Warnings
18 Notes
45764 Objects were scanned with rootkit scan
6 Hidden objects were found
Aidez moi svp,je ne sais pas quoi faire.J'attends vos nouvelles...
Merci bcp. Maria...
P.C : est-ce que j'ai bien donne les bonnes infos a propos de mon pc(materiel,syst. d'expl.,navigateur)??Ou faut-il autre chose???:(
jorginho67
Messages postés14716Date d'inscriptionmardi 11 septembre 2007StatutContributeur sécuritéDernière intervention11 février 20111 169 18 juil. 2008 à 23:57
Bonsoir Maria...
Pour vérifier :
Télécharge Hijackthis
Hijackthis (HJT) est un outil de diagnostic pour voir si tout va bien avec ton pc....
*.Enregistre HJTInstall.exe sur ton bureau
*. Double-clique sur HJTInstall.exe pour lancer le programme
*. Par défaut, il s'installera là C:\Program Files\Trend Micro\HijackThis
*. Accepte la license en cliquant sur le bouton "I Accept"
*. Choisis l'option "Do a system scan and save a log file"
*. Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
*. Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport
*. Colle le rapport que tu viens de copier sur ce forum *. Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement
mariafromgreece
Messages postés3Date d'inscriptionvendredi 18 juillet 2008StatutMembreDernière intervention19 novembre 2008 19 juil. 2008 à 10:54
Bonjour!!
Merci de votre aide,je vais telecharger Hijackthis lundi et faire delete aussi comme vous m'avez dit et je jvous tiens au courant...j'espere que ca va marcher. Merci encore...
Biz
