Warning!spyware detected on your computer

mi78 -  
Bonjour,

un message sur fond bleu disant "warning!spyware detected on your computer" a remplacé mon fond d'écran. J'ai tenté de men débarrassé san succès.

De plus, "antivirus xp 2008" s'est installé.Il scanne mon PC sans ke je lui demande et ne cesse de m'indiquer maintenant dans une bulle (venant d'une icône en bas de l'écran) que jai 2624 virus et me recommmande de desinfecté le plus tôt possible. S'agit-il dun virus ?

Mon antivirus Antivir ne me permets pas d'enlever tout ça.
Je ne sai vraiment pas comment faire. Pouvez-vous m'aider svp?
Configuration: Windows XP
Internet Explorer 6.0

12 réponses

  • Votes
  • Date
  • Date décroissante
  1. Destrio5 Modérateur
    Salut,

    Antivirus xp 2008 est un rogue, une infection se faisant passer pour un logiciel de sécurité.

    - Télécharge HijackThis V 2.02 (HijackThis Installer) :
    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

    - Clique sur Install ensuite sur I Accept

    - Clique sur Do a scan system and save log file

    - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
    1. mi78 Auteur
      salut Destrio5!
      Merci de ta réponse. Voici le rapport de HijackThis:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 16:03:59, on 21/07/2008
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 (6.00.2600.0000)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      C:\WINDOWS\System32\cisvc.exe
      C:\WINDOWS\System32\lxctcoms.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\system32\pctspk.exe
      C:\Program Files\Kerio\Personal Firewall\persfw.exe
      C:\Program Files\Lexmark 5400 Series\lxctmon.exe
      C:\Program Files\Lexmark 5400 Series\ezprint.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
      C:\WINDOWS\System32\lphc1c1j0ep3a.exe
      C:\Program Files\rhc5c1j0ep3a\rhc5c1j0ep3a.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      D:\Mes_documents\Sony Ericsson w910i Loly\Sony Ericsson PC Suite\SEPCSuite.exe
      C:\WINDOWS\System32\WgaTray.exe
      C:\WINDOWS\System32\pphc1c1j0ep3a.exe
      C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\WINDOWS\System32\cidaemon.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
      O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
      O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
      O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
      O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
      O4 - HKLM\..\Run: [Windows Network Service] wrziopb.exe
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKLM\..\Run: [lphc1c1j0ep3a] C:\WINDOWS\System32\lphc1c1j0ep3a.exe
      O4 - HKLM\..\Run: [SMrhc5c1j0ep3a] C:\Program Files\rhc5c1j0ep3a\rhc5c1j0ep3a.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [Windows Network Service] wrziopb.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "D:\Mes_documents\Sony Ericsson w910i Loly\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
      O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
      O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
      O15 - Trusted Zone: http://*.mcafee.com
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
      O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
      O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
      O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.photoservice.com/aurigma/ImageUploader4.cab
      O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: lxct_device - - C:\WINDOWS\System32\lxctcoms.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
      O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
      1. Destrio5 Modérateur
        - Télécharge et installe MalwareByte's Anti-Malware :
        http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

        - Mets-le à jour

        - Redémarre en mode sans échec (Recommandé) :
        https://www.malekal.com/demarrer-windows-mode-sans-echec/

        - Choisis ta session habituelle

        - Fais un scan complet avec MalwareByte's Anti-Malware

        - Supprime tout ce que le logiciel trouve, enregistre le rapport

        - Redémarre en mode normal et poste le rapport ici

        Tutorial :
        https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
        1. mi78
          Resalut Destrio5 !

          je suis contente mon PC semble aller beaucoup mieux!
          L'icône d'antivirus xp 2008 est partie. J'ai vérifié dans panneau de configuration et le virus a bien été supprimé.
          Par ailleurs, Le message "Warning..." a bien disparu de mon fond d'écran. Le fond est resté bleu mais jai pu remettre un fond d'ecran de mon choix manuellement.

          Après avoir redémarrer en mode normal j'ai supprimé tous les fichiers que Malwarebytes a mis en quarantaine .
          y-a-til d'autres manipulations à faire pour s'assurer que tout est bien propre ? Et comment éviter que cela ne se reproduiz?

          Voici le rapport obtenu:

          Malwarebytes' Anti-Malware 1.22
          Version de la base de données: 973
          Windows 5.1.2600

          20:16:15 21/07/2008
          mbam-log-7-21-2008 (20-16-15).txt

          Type de recherche: Examen complet (C:\|D:\|)
          Eléments examinés: 87578
          Temps écoulé: 1 hour(s), 57 minute(s), 1 second(s)

          Processus mémoire infecté(s): 0
          Module(s) mémoire infecté(s): 0
          Clé(s) du Registre infectée(s): 3
          Valeur(s) du Registre infectée(s): 8
          Elément(s) de données du Registre infecté(s): 2
          Dossier(s) infecté(s): 12
          Fichier(s) infecté(s): 35

          Processus mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Module(s) mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Clé(s) du Registre infectée(s):
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc5c1j0ep3a (Rogue.Multiple) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\rhc5c1j0ep3a (Rogue.Multiple) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

          Valeur(s) du Registre infectée(s):
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc1c1j0ep3a (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc5c1j0ep3a (Rogue.Multiple) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Network Service (Backdoor.Bot) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Network Service (Backdoor.Bot) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

          Elément(s) de données du Registre infecté(s):
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

          Dossier(s) infecté(s):
          C:\Program Files\rhc5c1j0ep3a (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\rhc5c1j0ep3a\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.

          Fichier(s) infecté(s):
          C:\WINDOWS\system32\lphc1c1j0ep3a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\C.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\D.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\E.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temporary Internet Files\Content.IE5\15S2CRX7\15[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\System Volume Information\_restore{0190D5C5-168D-4EFA-92A9-3BECC01233D6}\RP1\A0001005.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\System Volume Information\_restore{0190D5C5-168D-4EFA-92A9-3BECC01233D6}\RP1\A0001014.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\System Volume Information\_restore{0190D5C5-168D-4EFA-92A9-3BECC01233D6}\RP1\A0001022.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\rhc5c1j0ep3a.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\rhc5c1j0ep3a.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Program Files\rhc5c1j0ep3a\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
          C:\WINDOWS\Prefetch\YAHOOMESSENGER.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\phc1c1j0ep3a.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\blphc1c1j0ep3a.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
          C:\Documents and Settings\razafindrabe\Local Settings\Temp\s1265.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      2. Destrio5 Modérateur
        ---> Relance MBAM, va dans Quarantaine et supprime tout.

        ---> Poste un nouveau rapport HijackThis.
        2. mi78 Auteur
          Voici le nouveau rapport HijackThis :

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 21:08:27, on 21/07/2008
          Platform: Windows XP (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 (6.00.2600.0000)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
          C:\WINDOWS\System32\cisvc.exe
          C:\WINDOWS\System32\lxctcoms.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\System32\dllcache\wintcps.exe
          C:\Program Files\Lexmark 5400 Series\lxctmon.exe
          C:\Program Files\Lexmark 5400 Series\ezprint.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
          C:\Program Files\MSN Messenger\msnmsgr.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
          C:\WINDOWS\System32\nvsvc32.exe
          D:\Mes_documents\Sony Ericsson w910i Loly\Sony Ericsson PC Suite\SEPCSuite.exe
          C:\WINDOWS\system32\pctspk.exe
          C:\Program Files\Kerio\Personal Firewall\persfw.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\WINDOWS\System32\WgaTray.exe
          C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
          C:\WINDOWS\System32\wuauclt.exe
          C:\WINDOWS\System32\cidaemon.exe
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
          O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
          O15 - Trusted Zone: http://*.mcafee.com
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
          O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
          O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
          O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.photoservice.com/aurigma/ImageUploader4.cab
          O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
          O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
          O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: lxct_device - - C:\WINDOWS\System32\lxctcoms.exe
          O23 - Service: Microsoft Windows TCP Protocol - Unknown owner - C:\WINDOWS\System32\dllcache\wintcps.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
          O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
          O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
          2. mi78 Auteur
            Voici un nouveau rapport Hijack:

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 23:46:32, on 21/07/2008
            Platform: Windows XP (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 (6.00.2600.0000)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
            C:\WINDOWS\System32\cisvc.exe
            C:\WINDOWS\System32\lxctcoms.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
            C:\WINDOWS\System32\dllcache\wintcps.exe
            C:\Program Files\Lexmark 5400 Series\lxctmon.exe
            C:\Program Files\Lexmark 5400 Series\ezprint.exe
            C:\Program Files\QuickTime\qttask.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
            C:\WINDOWS\System32\nvsvc32.exe
            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
            C:\Program Files\MSN Messenger\msnmsgr.exe
            C:\WINDOWS\system32\pctspk.exe
            C:\Program Files\Kerio\Personal Firewall\persfw.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
            D:\Mes_documents\Sony Ericsson w910i Loly\Sony Ericsson PC Suite\SEPCSuite.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\WINDOWS\System32\WgaTray.exe
            C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
            C:\WINDOWS\System32\wuauclt.exe
            C:\WINDOWS\System32\cidaemon.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
            O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
            O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
            O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
            O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
            O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
            O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
            O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
            O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "D:\Mes_documents\Sony Ericsson w910i Loly\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
            O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
            O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
            O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
            O15 - Trusted Zone: http://*.mcafee.com
            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
            O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
            O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
            O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
            O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.photoservice.com/aurigma/ImageUploader4.cab
            O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
            O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
            O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
            O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
            O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: lxct_device - - C:\WINDOWS\System32\lxctcoms.exe
            O23 - Service: Microsoft Windows TCP Protocol - Unknown owner - C:\WINDOWS\System32\dllcache\wintcps.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
            O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
            O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
            4. mi78 Auteur
              salut Destrio5!
              jai mis mon Windows a jour. Tout semble bien fonctionner!
              Ya-til dautres choses ke je dois faire ?
              1. Destrio5 Modérateur
                Poste un nouveau rapport HijackThis car je vais te faire fixer des lignes.

                Discussions similaires

                usb device over current
                jean-michel

                39 réponses
                Boot failure detected
                Loshxn

                1 réponse
                suite au message "secure boot violation" impossible d'accéder à window
                Walloute

                9 réponses
                Message " Your chassis has been opened"
                tophe70

                14 réponses
                Symbole Attention dans Word
                Nortec59

                33 réponses