Probléme Antivirus XP 2008

cvs87 -  
Bonjour,

j'ai le logiciel Antivirus XP 2008 qui m'a infecté, que dois-je faire?

Cordialement
cvs87
Configuration: Windows XP
Firefox 2.0.0.16

20 réponses

Résumé de la discussion

Une infection par Antivirus XP 2008 est signalée et demande des conseils concrets pour nettoyer un système Windows XP et supprimer le spyware associé présent. Plusieurs recommandations privilégient des outils de détection et de désinfection tels que SpyBot A2 Free et AVG 8, avec l’important rappel de maintenir les navigateurs à jour. D'autres suggèrent d'effectuer un rapport HijackThis et d'exécuter Malwarebytes, parfois après une étape initiale de nettoyage complémentaire et la désactivation temporaire de certains modules malveillants. En cas de doute, certains rappellent qu’Antivirus XP 2008 est un logiciel malveillant combinant virus et spyware, nécessitant une approche pluridisciplinaire et une vérification approfondie du système.

Bobot (l’IA à votre service)
  1. geoffrey5 Contributeur sécurité
    Salut !!

    Télécharge hijackthis à cette adresse, tout est expliqué pour bien l installer et pour savoir s'en servir :

    https://www.androidworld.fr/
    0
    1. avrel820
      Bonjour tu as de la chance g reparer un ordi infecter par ca hier
      0
      1. mido
        cvs87,

        Telecharger malwarebytes : http://www.malwarebytes.org/mbam/program/mbam-setup.exe

        Installer / màj, lancer un scan complet et supprimer toute les infections trouvés.
        Afficher le rapport

        Tutoriel malwarebytes : http://www.pcinfo-web.com/

        Et afficher également un rapport HijackThis
        0
        1. avrel820
          mido j'espere que malwarebytes s'aucupe de viruses et de spywear
          0
      2. geoffrey5 Contributeur sécurité
        avrel cit : Bonjour tu as de la chance g reparer un ordi infecter par ca hier

        Si tu n as pas utilisé malwarebytes, l ordi que tu as réparé n est pas vraiment réparé lol
        0
        2. avrel820
          Pfff Encors un qui croit tout savoire lol
          0
          1. geoffrey5 Contributeur sécurité
            Je ne crois pas tout savoir mais je connais beaucoup de choses c est vrai ;-)
            0
            1. geoffrey5 Contributeur sécurité
              cvs87 : il vaudrait mieux que tu fasses d abord un rapport hijackthis avant de faire malwarebytes, il faut peut etre exécuter d autres programmes de désinfection avant...
              0
              1. avrel820
                Ah bon alors tu dois savoir qu’Antivirus XP 2008 est un virus avec un spyware
                0
                1. geoffrey5 Contributeur sécurité
                  antivirus XP 2008 est un rogue (un faux logiciel de protection) et il faut utiliser d autres programmes avant malwarebytes...
                  0
                  1. avrel820
                    Heureusement que il faut d’autre programmes SpyBot A2 Free et AVG 8 suffisent
                    0
                    1. geoffrey5 Contributeur sécurité
                      mdr...est ce que tu sais lire un rapport hijackthis ??
                      0
                      1. cvs87 Auteur
                        Voici le rapport HijackThis:

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 11:36:13, on 13/08/2008
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
                        C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                        C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
                        C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Wanadoo\GestionnaireInternet.exe
                        C:\Program Files\Wanadoo\ComComp.exe
                        C:\PROGRA~1\Wanadoo\Toaster.exe
                        C:\PROGRA~1\Wanadoo\Inactivity.exe
                        C:\PROGRA~1\Wanadoo\PollingModule.exe
                        C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
                        C:\WINDOWS\system32\pphc1n4j0ep6r.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Wanadoo\Watch.exe
                        C:\WINDOWS\system32\wuauclt.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\HJT.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
                        O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
                        O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
                        O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
                        O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
                        O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
                        O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
                        O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
                        O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
                        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                        O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                        O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                        O4 - HKLM\..\Run: [SMrhc5n4j0ep6r] C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
                        O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
                        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                        O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                        O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer = 80.10.246.130 81.253.149.10
                        O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        0
                        1. avrel820
                          HijackThis sert a indiquer les infection oublier et encor pressant
                          0
                          1. geoffrey5 Contributeur sécurité
                            les infections oubliées ?! ^^
                            0
                          2. buginformatik Contributeur
                            avrel820, au lieu de polluer le post de cvs87 et geoffrey5 tu voudrais pas "aider" des gens sans réponses ?

                            De plus je trouve ta vision d'hijackthis un peu bateau

                            Mais cela n'engage que moi

                            ++
                            0
                          3. geoffrey5 Contributeur sécurité
                            @buginformatikmerci pour l intervention et ta précision sur sa vision buginformatik lol ;-)
                            0
                          4. buginformatik Contributeur
                            @geoffrey5J'ai dû mal à voir si c'est ironique ou pas

                            XD
                            0
                        2. geoffrey5 Contributeur sécurité
                          Commence par faire ceci stp :

                          Option 1 - Recherche :

                          télécharge smitfraudfix et enregistre le sur le bureau à cette adresse (c est le numéro 2 en bas de la page) :

                          https://www.androidworld.fr/

                          Ensuite double clique sur smitfraudfix puis exécuter

                          Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

                          copier/coller le rapport dans la réponse.
                          0
                          1. geoffrey5 Contributeur sécurité
                            Tu as le virus braviax aussi...on va s en occuper ;-)
                            0
                            1. cvs87 Auteur
                              Voici le rapport smitfraudfix:

                              SmitFraudFix v2.336

                              Rapport fait à 12:02:26,09, 13/08/2008
                              Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
                              OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                              Le type du système de fichiers est NTFS
                              Fix executé en mode normal

                              »»»»»»»»»»»»»»»»»»»»»»»» Process

                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
                              C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                              C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
                              C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Wanadoo\GestionnaireInternet.exe
                              C:\Program Files\Wanadoo\ComComp.exe
                              C:\PROGRA~1\Wanadoo\Toaster.exe
                              C:\PROGRA~1\Wanadoo\Inactivity.exe
                              C:\PROGRA~1\Wanadoo\PollingModule.exe
                              C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
                              C:\WINDOWS\system32\pphc1n4j0ep6r.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\Program Files\Wanadoo\Watch.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Mozilla Firefox\firefox.exe
                              C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
                              C:\WINDOWS\system32\cmd.exe

                              »»»»»»»»»»»»»»»»»»»»»»»» hosts

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau\Application Data

                              »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHATEA~1\Favoris

                              »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                              »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                              »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                              »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                              »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              IEDFix
                              Credits: Malware Analysis & Diagnostic
                              Code: S!Ri

                              »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              VACFix
                              Credits: Malware Analysis & Diagnostic
                              Code: S!Ri

                              »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              404Fix
                              Credits: Malware Analysis & Diagnostic
                              Code: S!Ri

                              »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              SrchSTS.exe by S!Ri
                              Search SharedTaskScheduler's .dll

                              »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                              "AppInit_DLLs"=""

                              »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                              "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe,"
                              "System"=""

                              »»»»»»»»»»»»»»»»»»»»»»»» Rustock

                              »»»»»»»»»»»»»»»»»»»»»»»» DNS

                              Description: WAN (PPP/SLIP) Interface
                              DNS Server Search Order: 81.253.149.9
                              DNS Server Search Order: 80.10.246.132

                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132
                              HKLM\SYSTEM\CS1\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132

                              »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                              »»»»»»»»»»»»»»»»»»»»»»»» Fin

                              Merci
                              0
                              2. cvs87 Auteur
                                Voici le rapport malwarebytes:

                                Malwarebytes' Anti-Malware 1.24
                                Version de la base de données: 1047
                                Windows 5.1.2600 Service Pack 2

                                13:14:36 13/08/2008
                                mbam-log-8-13-2008 (13-14-36).txt

                                Type de recherche: Examen complet (C:\|)
                                Eléments examinés: 64753
                                Temps écoulé: 49 minute(s), 58 second(s)

                                Processus mémoire infecté(s): 2
                                Module(s) mémoire infecté(s): 3
                                Clé(s) du Registre infectée(s): 4
                                Valeur(s) du Registre infectée(s): 6
                                Elément(s) de données du Registre infecté(s): 3
                                Dossier(s) infecté(s): 18
                                Fichier(s) infecté(s): 49

                                Processus mémoire infecté(s):
                                C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Unloaded process successfully.
                                C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Unloaded process successfully.

                                Module(s) mémoire infecté(s):
                                C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Delete on reboot.
                                C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.
                                C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.

                                Clé(s) du Registre infectée(s):
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\rhc5n4j0ep6r (Rogue.Multiple) -> Delete on reboot.
                                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpsr (Rootkit.Agent) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

                                Valeur(s) du Registre infectée(s):
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

                                Elément(s) de données du Registre infecté(s):
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

                                Dossier(s) infecté(s):
                                C:\WINDOWS\system32\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\data (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\NetworkService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\LocalService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

                                Fichier(s) infecté(s):
                                C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\install.exe (Rogue.Installer) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\XPSecurityCenter.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000436.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000442.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000449.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000455.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP11\A0000567.exe (Rogue.Installer) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000365.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000366.exe (Rogue.Installer) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000377.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000383.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000406.exe (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\F1.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\F2.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\F7.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\winivstr.exe (Rogue.Installer) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\wsnpoem\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\htmlayout.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\pthreadVC2.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\un.ico (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\unzip32.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\wscui.cpl (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\XP_SecurityCenter.cfg (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\data\daily.cvd (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcm80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcp80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcr80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Program Files\rhc5n4j0ep6r\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\blphc1n4j0ep6r.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\phc1n4j0ep6r.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\All Users\Bureau\XPSecurityCenter.lnk (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Chateau Magneau\Cookies\qiqyqopepy.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

                                Merci
                                0
                                2. geoffrey5 Contributeur sécurité
                                  refais un nouveau rapport hijackthis stp cvs87
                                  0

                                  Discussions similaires

                                  Ou trouver le pilote pour epson xp-2205
                                  lutttinette

                                  19 réponses
                                  probleme configuration wifi epson xp-225
                                  sam099

                                  35 réponses
                                  Google Chrome "  Échec de l'analyse antivirus "
                                  jmpower

                                  18 réponses