Problème avec "vista antivirus 2008"

Quatorze -  
Bonjour,

j'ai un gros souci avec une chose qui s'appelle : "vista antivirus 2008"
si un(e) petit(e) génie pouvait m'aider à éradiquer ce "truk"..
cela fait deux jours que je suis en mode sans échec.
avast n'y peut rien, spybot non plus , ad-aware pareil..
je suis perdu et débutant.

d'avance merci.
Configuration: Windows XP
Internet Explorer 7.0

41 réponses

Résumé de la discussion

Vista Antivirus 2008 pose une infection persistance sur Windows XP, résistante au mode sans échec et aux outils classiques comme Avast, Spybot et Ad-Aware notamment. Plusieurs conseils préconisent d'utiliser Malwarebytes en analyse complète, de cocher l'option « Arrêter Internet Explorer pendant la suppression », puis de supprimer les éléments détectés et de sauvegarder le rapport. Des méthodes complémentaires mentionnées incluent l'emploi de HiJackThis et MoveIt pour nettoyer les entrées système, avec le besoin éventuel de renommer l'outil et de suivre un tutoriel pour l'analyse des rapports. Par ailleurs, des échanges indiquent que le problème peut persister malgré les nettoyages et que le recours à un support technique peut être nécessaire, ce qui n'était pas explicitement résolu.

Bobot (l’IA à votre service)
  1. buginformatik Contributeur
    oui c'est assez simple...

    Télécharges hijackthis : http://www.trendsecure.com/portal/en-US/_download/HiJackThis­.exe

    et voici un tuto pour bien l'installer : https://forums.cnetfrance.fr

    - une fois installé, le renommer HJT.exe pour contrer une éventuelle infection vundo
    - Double-clic dessus
    - Clic sur "Do a system scan and save the log"
    - Copies le rapport, le coller dans la réponse

    Ensuite tu téléchargera MoveIt : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
    0
    1. Utilisateur anonyme
      re

      c bizarre a 19h57 tu n avais pas le temps ....

      @++
      0
    2. buginformatik Contributeur
      @Utilisateur anonymeJ'allais justement sur l'autre topic... Les imprévus tu connais ?
      0
  2. idilik
    http://www.windowsvistaplace.com/antivirus2008-antivirus-2008-removal-instructions/software/fr/

    0
    1. Quatorze Auteur
      merci bcp je vais essayer ce que tu me proposes.
      0
      1. Quatorze Auteur
        je commence par le tuto?..
        0
        1. buginformatik Contributeur
          De Hijackthis ?
          0
      3. Quatorze Auteur
        bon..déjà je crois que j'ai bien téléchargé hijackthis et l'ai renommé..ouf.
        0
        1. Quatorze Auteur
          Voici le rapport..
          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
          R3 - Default URLSearchHook is missing
          O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: qndsfmao - {3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\WINDOWS\qndsfmao.dll (file missing)
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
          O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
          O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [34c840b1] rundll32.exe "C:\WINDOWS\system32\mqckwrmp.dll",b
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
          O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
          O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O15 - Trusted Zone: http://www.secuser.com
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://dariasworld.spaces.live.com//PhotoUpload/MsnPUpld.cab
          O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
          O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
          O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
          O21 - SSODL: kvxqmtre - {4EC71C23-8AAC-4165-85C3-39B4C50B53F6} - C:\WINDOWS\kvxqmtre.dll (file missing)
          O21 - SSODL: evgratsm - {E45718AB-573B-4DC0-A17E-C63FA073AD7C} - C:\WINDOWS\evgratsm.dll (file missing)
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

          --
          0
          2. buginformatik Contributeur
            - Double-cliquez sur OTMoveIt2.exe pour le lancer.
            - Copiez le texte ci-dessous (sans les "") :

            "C:\Program Files\VAV"

            - Dans Paste List of Files/Folders to Move, colle le texte que tu as copié auparavant.
            - Clique sur le bouton rouge MoveIt
            - Fermer OTMoveIt2
            0
            1. Quatorze Auteur
              il me note fichier VAV non trouvé
              0
              1. buginformatik Contributeur
                Oui et je ne trouvais pas de trace dans le rapport HJT... C'est quoi ton problème ?
                0
                1. Quatorze Auteur
                  bah je pense qu'à force de m'énerver ce truk j'ai bidouillé et que j'ai supprimer un fichier VAV.exe tt à l'heure..il n'est donc plus là..
                  0
                2. Quatorze Auteur
                  @Quatorzevoici le rapport
                  Malwarebytes' Anti-Malware 1.22
                  Version de la base de données: 976
                  Windows 5.1.2600 Service Pack 2

                  22:47:31 21/07/2008
                  mbam-log-7-21-2008 (22-47-31).txt

                  Type de recherche: Examen complet (C:\|D:\|)
                  Eléments examinés: 90818
                  Temps écoulé: 29 minute(s), 2 second(s)

                  Processus mémoire infecté(s): 0
                  Module(s) mémoire infecté(s): 2
                  Clé(s) du Registre infectée(s): 16
                  Valeur(s) du Registre infectée(s): 4
                  Elément(s) de données du Registre infecté(s): 3
                  Dossier(s) infecté(s): 8
                  Fichier(s) infecté(s): 53

                  Processus mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Module(s) mémoire infecté(s):
                  C:\WINDOWS\system32\fccAQiIC.dll (Trojan.Vundo) -> Unloaded module successfully.
                  C:\WINDOWS\system32\xxyyaYPh.dll (Trojan.Vundo) -> Unloaded module successfully.

                  Clé(s) du Registre infectée(s):
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0e20bda8-55c6-49e7-8926-f0a640e0be12} (Trojan.Vundo) -> Delete on reboot.
                  HKEY_CLASSES_ROOT\CLSID\{0e20bda8-55c6-49e7-8926-f0a640e0be12} (Trojan.Vundo) -> Delete on reboot.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6067287c-7350-422a-ac1a-ef0672361c02} (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\CLSID\{6067287c-7350-422a-ac1a-ef0672361c02} (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\CLSID\{2a65be74-ec8d-401e-93df-5bda3dc05505} (Trojan.Vundo) -> Delete on reboot.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2a65be74-ec8d-401e-93df-5bda3dc05505} (Trojan.Vundo) -> Delete on reboot.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyyayph (Trojan.Vundo) -> Delete on reboot.
                  HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\qndsfmao.bvqe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                  HKEY_CLASSES_ROOT\qndsfmao.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                  Valeur(s) du Registre infectée(s):
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34c840b1 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{2a65be74-ec8d-401e-93df-5bda3dc05505} (Trojan.Vundo) -> Delete on reboot.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\evgratsm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\kvxqmtre (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                  Elément(s) de données du Registre infecté(s):
                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccaqiic -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccaqiic -> Delete on reboot.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76412-OEM-0058035-34185) -> Quarantined and deleted successfully.

                  Dossier(s) infecté(s):
                  C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
                  C:\Program Files\AVM (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\BASE (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\DELETED (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\SAVED (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.

                  Fichier(s) infecté(s):
                  C:\WINDOWS\system32\fccAQiIC.dll (Trojan.Vundo) -> Delete on reboot.
                  C:\WINDOWS\system32\CIiQAccf.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\CIiQAccf.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\qehzgg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\mqckwrmp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\pmrwkcqm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\skqxdaji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ijadxqks.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\xxyyaYPh.dll (Trojan.Vundo) -> Delete on reboot.
                  C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7OGYASQ8\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\GKAP4M5L\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\MBWFZ4DQ\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\MXJCTPV4\install_4683_MHwzNHwwfHx8fHx8fHw_[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\NZYZLWX4\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\W9L3364J\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Program Files\AVM\avm.exe (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
                  C:\Program Files\PCHealthCenter\0.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                  C:\Program Files\PCHealthCenter\5.exe (Rogue.Installer) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131810.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131811.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131812.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131874.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131875.cpl (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP893\A0132150.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP893\A0132166.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP893\A0132167.exe (Rogue.Installer) -> Quarantined and deleted successfully.
                  C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP894\A0132277.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\aumwnxri.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ddcCutUl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\qhqibxdp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ssqOGxWQ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\twkfbe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\urqNFwwx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
                  C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
                  C:\Program Files\AVM\avm.ooo (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
                  C:\Program Files\AVM\avm0.dat (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
                  C:\Program Files\AVM\avm1.dat (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719181734890.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719182142656.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719184542890.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719210413406.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719223640328.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719230151703.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719230502109.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
                  C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Application Data\TmpRecentIcons\Vista Antivirus 2008.lnk (Rogue.Link) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Bureau\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Bureau\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Bureau\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\test\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
                  0
              2. buginformatik Contributeur
                Il t'embête encore ?
                0
                1. Quatorze Auteur
                  là je suis en ode sans échec mais je sais que dés que je vais me remettre en mode normal ce p....de vista antivirus 2008 va se redéclencher..pffff
                  0
                  1. buginformatik Contributeur
                    Remets toi en mode normal et vois...
                    0
                    1. Quatorze Auteur
                      Bonjour Buginformatik

                      je n'arrive malheureusement pas à retrouver la deuxième page de notre discussion d'hier soir..
                      j'ai bien exécuté l'anti malware et j'ai posté le rapport mais je crois que tu n'as pa du l'avoir...?
                      j'espère m'en sortir avec ce p.... de virus..et que tu seras là ce soir pour m'aider.
                      0
                  3. Quatorze Auteur
                    en fait j'ai fait tout à l'heure (desespéré) une recherche de ce fichier (VAV.exe)
                    et j'ai donc trouvé le chemin et l'ai simplement balançé dans ma corbeille..
                    j'ai bien évidemment vidé ma corbeille..comme une truffe..
                    j'ai rebouté en mode normal et mon "ami" est encore bien présent..
                    j'espère ue ce n'est pas rédhibitoire..
                    Help!..
                    0
                    1. Quatorze Auteur
                      j'ai refait un rapport au cas ou..
                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                      R3 - Default URLSearchHook is missing
                      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                      O3 - Toolbar: qndsfmao - {3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\WINDOWS\qndsfmao.dll (file missing)
                      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                      O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                      O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
                      O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
                      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKLM\..\Run: [34c840b1] rundll32.exe "C:\WINDOWS\system32\mqckwrmp.dll",b
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
                      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O15 - Trusted Zone: http://www.secuser.com
                      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://dariasworld.spaces.live.com//PhotoUpload/MsnPUpld.cab
                      O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
                      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
                      O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                      O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
                      O21 - SSODL: kvxqmtre - {4EC71C23-8AAC-4165-85C3-39B4C50B53F6} - C:\WINDOWS\kvxqmtre.dll (file missing)
                      O21 - SSODL: evgratsm - {E45718AB-573B-4DC0-A17E-C63FA073AD7C} - C:\WINDOWS\evgratsm.dll (file missing)
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      0
                      1. Quatorze Auteur
                        je crois que cela n'a servi à rien..j'ai refait la même manip et le fichier est toujours not found..
                        qu'est-ce-que je peux faire maintenant?..
                        0
                        1. Utilisateur anonyme
                          Salut,

                          plusieures infections

                          Telecharge malwarebytes

                          -> http://www.malwarebytes.org/mbam/program/mbam-setup.exe

                          Tu l´instale; le programme va se mettre automatiquement a jour.

                          Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                          Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

                          Puis click sur "rechercher".

                          Laisse le scanner le pc...

                          Si des elements on ete trouvés > click sur supprimer la selection.

                          si il t´es demandé de redemarrer > click sur "yes".

                          A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

                          Copie et colle le rapport stp.

                          ps : les rapport sont aussi rangé dans l onglet rapport/log
                          0
                          1. Quatorze Auteur
                            j'ai bien lancé malwarebyte..il a tout scanné..
                            mais aucun message pour supprimer les infections..pas de rapport!?..
                            0
                        2. Utilisateur anonyme
                          mais aucun message pour supprimer les infections..pas de rapport!?..

                          a la fin du scan tu as "supprimé la selection"

                          les rapport sont dans l onglet rapport/log
                          0
                          • 1
                          • 2
                          • 3

                          Discussions similaires

                          Google Chrome "  Échec de l'analyse antivirus "
                          jmpower

                          18 réponses
                          " Échec de l'analyse antivirus " la solution.
                          bazfile

                          0 réponse
                          Échec de l'analyse anti virus.
                          alice1414

                          3 réponses