Problème avec "vista antivirus 2008"

Quatorze Messages postés 38 Statut Membre -  
Quatorze Messages postés 38 Statut Membre -
Bonjour,

j'ai un gros souci avec une chose qui s'appelle : "vista antivirus 2008"
si un(e) petit(e) génie pouvait m'aider à éradiquer ce "truk"..
cela fait deux jours que je suis en mode sans échec.
avast n'y peut rien, spybot non plus , ad-aware pareil..
je suis perdu et débutant.

d'avance merci.
Configuration: Windows XP
Internet Explorer 7.0

41 réponses

  • 1
  • 2
  • 3
Résumé de la discussion

Vista Antivirus 2008 pose une infection persistance sur Windows XP, résistante au mode sans échec et aux outils classiques comme Avast, Spybot et Ad-Aware notamment. Plusieurs conseils préconisent d'utiliser Malwarebytes en analyse complète, de cocher l'option « Arrêter Internet Explorer pendant la suppression », puis de supprimer les éléments détectés et de sauvegarder le rapport. Des méthodes complémentaires mentionnées incluent l'emploi de HiJackThis et MoveIt pour nettoyer les entrées système, avec le besoin éventuel de renommer l'outil et de suivre un tutoriel pour l'analyse des rapports. Par ailleurs, des échanges indiquent que le problème peut persister malgré les nettoyages et que le recours à un support technique peut être nécessaire, ce qui n'était pas explicitement résolu.

Bobot (l'IA à votre service)
  1. buginformatik Messages postés 2210 Statut Contributeur 54
     
    oui c'est assez simple...

    Télécharges hijackthis : http://www.trendsecure.com/portal/en-US/_download/HiJackThis­.exe

    et voici un tuto pour bien l'installer : https://forums.cnetfrance.fr

    - une fois installé, le renommer HJT.exe pour contrer une éventuelle infection vundo
    - Double-clic dessus
    - Clic sur "Do a system scan and save the log"
    - Copies le rapport, le coller dans la réponse

    Ensuite tu téléchargera MoveIt : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
    0
    1. Utilisateur anonyme
       
      re

      c bizarre a 19h57 tu n avais pas le temps ....

      @++
      0
      1. buginformatik Messages postés 2210 Statut Contributeur 54 > Utilisateur anonyme
         
        J'allais justement sur l'autre topic... Les imprévus tu connais ?
        0
  2. idilik Messages postés 487 Statut Membre 46
     
    http://www.windowsvistaplace.com/antivirus2008-antivirus-2008-removal-instructions/software/fr/

    0
  3. Quatorze Messages postés 38 Statut Membre
     
    merci bcp je vais essayer ce que tu me proposes.
    0
  4. Quatorze Messages postés 38 Statut Membre
     
    je commence par le tuto?..
    0
    1. buginformatik Messages postés 2210 Statut Contributeur 54
       
      De Hijackthis ?
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Quatorze Messages postés 38 Statut Membre
     
    bon..déjà je crois que j'ai bien téléchargé hijackthis et l'ai renommé..ouf.
    0
  7. Quatorze Messages postés 38 Statut Membre
     
    Voici le rapport..
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: qndsfmao - {3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\WINDOWS\qndsfmao.dll (file missing)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
    O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [34c840b1] rundll32.exe "C:\WINDOWS\system32\mqckwrmp.dll",b
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.secuser.com
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://dariasworld.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
    O21 - SSODL: kvxqmtre - {4EC71C23-8AAC-4165-85C3-39B4C50B53F6} - C:\WINDOWS\kvxqmtre.dll (file missing)
    O21 - SSODL: evgratsm - {E45718AB-573B-4DC0-A17E-C63FA073AD7C} - C:\WINDOWS\evgratsm.dll (file missing)
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    --
    0
  8. Quatorze Messages postés 38 Statut Membre
     
    j'execute movelt?..
    0
  9. buginformatik Messages postés 2210 Statut Contributeur 54
     
    - Double-cliquez sur OTMoveIt2.exe pour le lancer.
    - Copiez le texte ci-dessous (sans les "") :

    "C:\Program Files\VAV"

    - Dans Paste List of Files/Folders to Move, colle le texte que tu as copié auparavant.
    - Clique sur le bouton rouge MoveIt
    - Fermer OTMoveIt2
    0
  10. Quatorze Messages postés 38 Statut Membre
     
    il me note fichier VAV non trouvé
    0
  11. buginformatik Messages postés 2210 Statut Contributeur 54
     
    Oui et je ne trouvais pas de trace dans le rapport HJT... C'est quoi ton problème ?
    0
    1. Quatorze Messages postés 38 Statut Membre
       
      bah je pense qu'à force de m'énerver ce truk j'ai bidouillé et que j'ai supprimer un fichier VAV.exe tt à l'heure..il n'est donc plus là..
      0
      1. Quatorze Messages postés 38 Statut Membre > Quatorze Messages postés 38 Statut Membre
         
        voici le rapport
        Malwarebytes' Anti-Malware 1.22
        Version de la base de données: 976
        Windows 5.1.2600 Service Pack 2

        22:47:31 21/07/2008
        mbam-log-7-21-2008 (22-47-31).txt

        Type de recherche: Examen complet (C:\|D:\|)
        Eléments examinés: 90818
        Temps écoulé: 29 minute(s), 2 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 2
        Clé(s) du Registre infectée(s): 16
        Valeur(s) du Registre infectée(s): 4
        Elément(s) de données du Registre infecté(s): 3
        Dossier(s) infecté(s): 8
        Fichier(s) infecté(s): 53

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        C:\WINDOWS\system32\fccAQiIC.dll (Trojan.Vundo) -> Unloaded module successfully.
        C:\WINDOWS\system32\xxyyaYPh.dll (Trojan.Vundo) -> Unloaded module successfully.

        Clé(s) du Registre infectée(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0e20bda8-55c6-49e7-8926-f0a640e0be12} (Trojan.Vundo) -> Delete on reboot.
        HKEY_CLASSES_ROOT\CLSID\{0e20bda8-55c6-49e7-8926-f0a640e0be12} (Trojan.Vundo) -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6067287c-7350-422a-ac1a-ef0672361c02} (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{6067287c-7350-422a-ac1a-ef0672361c02} (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{2a65be74-ec8d-401e-93df-5bda3dc05505} (Trojan.Vundo) -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2a65be74-ec8d-401e-93df-5bda3dc05505} (Trojan.Vundo) -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyyayph (Trojan.Vundo) -> Delete on reboot.
        HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\qndsfmao.bvqe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\qndsfmao.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.

        Valeur(s) du Registre infectée(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34c840b1 (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{2a65be74-ec8d-401e-93df-5bda3dc05505} (Trojan.Vundo) -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\evgratsm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\kvxqmtre (Trojan.FakeAlert) -> Quarantined and deleted successfully.

        Elément(s) de données du Registre infecté(s):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccaqiic -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccaqiic -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76412-OEM-0058035-34185) -> Quarantined and deleted successfully.

        Dossier(s) infecté(s):
        C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
        C:\Program Files\AVM (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\BASE (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\DELETED (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\SAVED (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.

        Fichier(s) infecté(s):
        C:\WINDOWS\system32\fccAQiIC.dll (Trojan.Vundo) -> Delete on reboot.
        C:\WINDOWS\system32\CIiQAccf.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\CIiQAccf.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\qehzgg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\mqckwrmp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\pmrwkcqm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\skqxdaji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\ijadxqks.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\xxyyaYPh.dll (Trojan.Vundo) -> Delete on reboot.
        C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7OGYASQ8\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\GKAP4M5L\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\MBWFZ4DQ\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\MXJCTPV4\install_4683_MHwzNHwwfHx8fHx8fHw_[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\NZYZLWX4\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\W9L3364J\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\Program Files\AVM\avm.exe (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
        C:\Program Files\PCHealthCenter\0.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\Program Files\PCHealthCenter\5.exe (Rogue.Installer) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131810.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131811.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131812.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131874.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP891\A0131875.cpl (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP893\A0132150.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP893\A0132166.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP893\A0132167.exe (Rogue.Installer) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{7B01A182-BDA6-4590-8D28-9768D957C877}\RP894\A0132277.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\aumwnxri.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\ddcCutUl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\qhqibxdp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\ssqOGxWQ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\twkfbe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\urqNFwwx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
        C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
        C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
        C:\Program Files\AVM\avm.ooo (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
        C:\Program Files\AVM\avm0.dat (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
        C:\Program Files\AVM\avm1.dat (Rogue.AntivirusMaster) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719181734890.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719182142656.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719184542890.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719210413406.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719223640328.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719230151703.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080719230502109.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully.
        C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Application Data\TmpRecentIcons\Vista Antivirus 2008.lnk (Rogue.Link) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Bureau\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Bureau\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Bureau\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
        C:\Documents and Settings\test\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
        0
  12. buginformatik Messages postés 2210 Statut Contributeur 54
     
    Il t'embête encore ?
    0
  13. Quatorze Messages postés 38 Statut Membre
     
    là je suis en ode sans échec mais je sais que dés que je vais me remettre en mode normal ce p....de vista antivirus 2008 va se redéclencher..pffff
    0
  14. buginformatik Messages postés 2210 Statut Contributeur 54
     
    Remets toi en mode normal et vois...
    0
    1. Quatorze Messages postés 38 Statut Membre
       
      Bonjour Buginformatik

      je n'arrive malheureusement pas à retrouver la deuxième page de notre discussion d'hier soir..
      j'ai bien exécuté l'anti malware et j'ai posté le rapport mais je crois que tu n'as pa du l'avoir...?
      j'espère m'en sortir avec ce p.... de virus..et que tu seras là ce soir pour m'aider.
      0
  15. Quatorze Messages postés 38 Statut Membre
     
    ok..
    0
  16. Quatorze Messages postés 38 Statut Membre
     
    en fait j'ai fait tout à l'heure (desespéré) une recherche de ce fichier (VAV.exe)
    et j'ai donc trouvé le chemin et l'ai simplement balançé dans ma corbeille..
    j'ai bien évidemment vidé ma corbeille..comme une truffe..
    j'ai rebouté en mode normal et mon "ami" est encore bien présent..
    j'espère ue ce n'est pas rédhibitoire..
    Help!..
    0
  17. Quatorze Messages postés 38 Statut Membre
     
    j'ai refait un rapport au cas ou..
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: qndsfmao - {3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\WINDOWS\qndsfmao.dll (file missing)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
    O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [34c840b1] rundll32.exe "C:\WINDOWS\system32\mqckwrmp.dll",b
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Sitecom\Logiciel Bluetooth\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.secuser.com
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://dariasworld.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
    O21 - SSODL: kvxqmtre - {4EC71C23-8AAC-4165-85C3-39B4C50B53F6} - C:\WINDOWS\kvxqmtre.dll (file missing)
    O21 - SSODL: evgratsm - {E45718AB-573B-4DC0-A17E-C63FA073AD7C} - C:\WINDOWS\evgratsm.dll (file missing)
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    0
  18. Quatorze Messages postés 38 Statut Membre
     
    je crois que cela n'a servi à rien..j'ai refait la même manip et le fichier est toujours not found..
    qu'est-ce-que je peux faire maintenant?..
    0
  19. Utilisateur anonyme
     
    Salut,

    plusieures infections

    Telecharge malwarebytes

    -> http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    Tu l´instale; le programme va se mettre automatiquement a jour.

    Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

    Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

    Puis click sur "rechercher".

    Laisse le scanner le pc...

    Si des elements on ete trouvés > click sur supprimer la selection.

    si il t´es demandé de redemarrer > click sur "yes".

    A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

    Copie et colle le rapport stp.

    ps : les rapport sont aussi rangé dans l onglet rapport/log
    0
    1. Quatorze Messages postés 38 Statut Membre
       
      j'ai bien lancé malwarebyte..il a tout scanné..
      mais aucun message pour supprimer les infections..pas de rapport!?..
      0
  20. Utilisateur anonyme
     
    mais aucun message pour supprimer les infections..pas de rapport!?..

    a la fin du scan tu as "supprimé la selection"

    les rapport sont dans l onglet rapport/log
    0
  21. Quatorze Messages postés 38 Statut Membre
     
    je le relance..
    0
  • 1
  • 2
  • 3

Discussions similaires

Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses
" Échec de l'analyse antivirus " la solution.
bazfile -
bazfile -

0 réponse