Probléme Antivirus XP 2008

cvs87 Messages postés 19 Statut Membre -  
geoffrey5 Messages postés 14008 Statut Contributeur sécurité -
Bonjour,

j'ai le logiciel Antivirus XP 2008 qui m'a infecté, que dois-je faire?

Cordialement
cvs87
Configuration: Windows XP
Firefox 2.0.0.16

20 réponses

  1.
    geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Salut !!

    Télécharge hijackthis à cette adresse, tout est expliqué pour bien l installer et pour savoir s'en servir :

    https://www.androidworld.fr/
    0
  2. avrel820
     
    Bonjour tu as de la chance g reparer un ordi infecter par ca hier
    0
  3. mido
     
    cvs87,

    Telecharger malwarebytes : http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    Installer / màj, lancer un scan complet et supprimer toute les infections trouvés.
    Afficher le rapport

    Tutoriel malwarebytes : http://www.pcinfo-web.com/

    Et afficher également un rapport HijackThis
    0
    1. avrel820
       
      mido j'espere que malwarebytes s'aucupe de viruses et de spywear
      0
  4. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    avrel cit : Bonjour tu as de la chance g reparer un ordi infecter par ca hier

    Si tu n as pas utilisé malwarebytes, l ordi que tu as réparé n est pas vraiment réparé lol
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. avrel820
     
    Pfff Encors un qui croit tout savoire lol
    0
  7. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Je ne crois pas tout savoir mais je connais beaucoup de choses c est vrai ;-)
    0
  8. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    cvs87 : il vaudrait mieux que tu fasses d abord un rapport hijackthis avant de faire malwarebytes, il faut peut etre exécuter d autres programmes de désinfection avant...
    0
  9. avrel820
     
    Ah bon alors tu dois savoir qu’Antivirus XP 2008 est un virus avec un spyware
    0
  10. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    antivirus XP 2008 est un rogue (un faux logiciel de protection) et il faut utiliser d autres programmes avant malwarebytes...
    0
  11. avrel820
     
    Heureusement que il faut d’autre programmes SpyBot A2 Free et AVG 8 suffisent
    0
  12. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    mdr...est ce que tu sais lire un rapport hijackthis ??
    0
  13. cvs87 Messages postés 19 Statut Membre
     
    Voici le rapport HijackThis:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:36:13, on 13/08/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
    C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Wanadoo\GestionnaireInternet.exe
    C:\Program Files\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\WINDOWS\system32\pphc1n4j0ep6r.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Wanadoo\Watch.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
    O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
    O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
    O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
    O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [SMrhc5n4j0ep6r] C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
    O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer = 80.10.246.130 81.253.149.10
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    0
  14. avrel820
     
    HijackThis sert a indiquer les infection oublier et encor pressant
    0
    1. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
       
      les infections oubliées ?! ^^
      0
    2. buginformatik Messages postés 2210 Statut Contributeur 54
       
      avrel820, au lieu de polluer le post de cvs87 et geoffrey5 tu voudrais pas "aider" des gens sans réponses ?

      De plus je trouve ta vision d'hijackthis un peu bateau

      Mais cela n'engage que moi

      ++
      0
      1. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10 > buginformatik Messages postés 2210 Statut Contributeur
         
        merci pour l intervention et ta précision sur sa vision buginformatik lol ;-)
        0
      2. buginformatik Messages postés 2210 Statut Contributeur 54 > geoffrey5 Messages postés 14008 Statut Contributeur sécurité
         
        J'ai dû mal à voir si c'est ironique ou pas

        XD
        0
  15. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Commence par faire ceci stp :

    Option 1 - Recherche :

    télécharge smitfraudfix et enregistre le sur le bureau à cette adresse (c est le numéro 2 en bas de la page) :

    https://www.androidworld.fr/

    Ensuite double clique sur smitfraudfix puis exécuter

    Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

    copier/coller le rapport dans la réponse.
    0
  16. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Tu as le virus braviax aussi...on va s en occuper ;-)
    0
  17. cvs87 Messages postés 19 Statut Membre
     
    Voici le rapport smitfraudfix:

    SmitFraudFix v2.336

    Rapport fait à 12:02:26,09, 13/08/2008
    Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode normal

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
    C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Wanadoo\GestionnaireInternet.exe
    C:\Program Files\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\WINDOWS\system32\pphc1n4j0ep6r.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Wanadoo\Watch.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHATEA~1\Favoris

    »»»»»»»»»»»»»»»»»»»»»»»» Bureau

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

    »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe,"
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: WAN (PPP/SLIP) Interface
    DNS Server Search Order: 81.253.149.9
    DNS Server Search Order: 80.10.246.132

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin

    Merci
    0
  19. cvs87 Messages postés 19 Statut Membre
     
    Voici le rapport malwarebytes:

    Malwarebytes' Anti-Malware 1.24
    Version de la base de données: 1047
    Windows 5.1.2600 Service Pack 2

    13:14:36 13/08/2008
    mbam-log-8-13-2008 (13-14-36).txt

    Type de recherche: Examen complet (C:\|)
    Eléments examinés: 64753
    Temps écoulé: 49 minute(s), 58 second(s)

    Processus mémoire infecté(s): 2
    Module(s) mémoire infecté(s): 3
    Clé(s) du Registre infectée(s): 4
    Valeur(s) du Registre infectée(s): 6
    Elément(s) de données du Registre infecté(s): 3
    Dossier(s) infecté(s): 18
    Fichier(s) infecté(s): 49

    Processus mémoire infecté(s):
    C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Unloaded process successfully.
    C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Unloaded process successfully.

    Module(s) mémoire infecté(s):
    C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Delete on reboot.
    C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.
    C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.

    Clé(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\rhc5n4j0ep6r (Rogue.Multiple) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpsr (Rootkit.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Dossier(s) infecté(s):
    C:\WINDOWS\system32\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\data (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\NetworkService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

    Fichier(s) infecté(s):
    C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\install.exe (Rogue.Installer) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\XPSecurityCenter.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000436.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000442.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000449.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000455.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP11\A0000567.exe (Rogue.Installer) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000365.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000366.exe (Rogue.Installer) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000377.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000383.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000406.exe (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\F1.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\F2.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\F7.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\winivstr.exe (Rogue.Installer) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wsnpoem\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\htmlayout.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\pthreadVC2.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\un.ico (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\unzip32.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\wscui.cpl (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\XP_SecurityCenter.cfg (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\data\daily.cvd (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcm80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcp80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcr80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Program Files\rhc5n4j0ep6r\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\blphc1n4j0ep6r.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\phc1n4j0ep6r.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Bureau\XPSecurityCenter.lnk (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Chateau Magneau\Cookies\qiqyqopepy.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

    Merci
    0
  20. cvs87 Messages postés 19 Statut Membre
     
    Merci, je n'ai plus d'autre manipulations à faire?
    0
  21. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    refais un nouveau rapport hijackthis stp cvs87
    0

Discussions similaires

Ou trouver le pilote pour epson xp-2205
lutttinette -
kaneagle -

19 réponses
probleme configuration wifi epson xp-225
sam099 -
Elchaco -

35 réponses
Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses