Probléme Antivirus XP 2008
Bonjour,
j'ai le logiciel Antivirus XP 2008 qui m'a infecté, que dois-je faire?
Cordialement
cvs87
j'ai le logiciel Antivirus XP 2008 qui m'a infecté, que dois-je faire?
Cordialement
cvs87
Configuration: Windows XP Firefox 2.0.0.16
20 réponses
Résumé de la discussion
Une infection par Antivirus XP 2008 est signalée et demande des conseils concrets pour nettoyer un système Windows XP et supprimer le spyware associé présent. Plusieurs recommandations privilégient des outils de détection et de désinfection tels que SpyBot A2 Free et AVG 8, avec l’important rappel de maintenir les navigateurs à jour. D'autres suggèrent d'effectuer un rapport HijackThis et d'exécuter Malwarebytes, parfois après une étape initiale de nettoyage complémentaire et la désactivation temporaire de certains modules malveillants. En cas de doute, certains rappellent qu’Antivirus XP 2008 est un logiciel malveillant combinant virus et spyware, nécessitant une approche pluridisciplinaire et une vérification approfondie du système.
-
Contributeur sécuritéSalut !!
Télécharge hijackthis à cette adresse, tout est expliqué pour bien l installer et pour savoir s'en servir :
https://www.androidworld.fr/ -
Bonjour tu as de la chance g reparer un ordi infecter par ca hier
-
cvs87,
Telecharger malwarebytes : http://www.malwarebytes.org/mbam/program/mbam-setup.exe
Installer / màj, lancer un scan complet et supprimer toute les infections trouvés.
Afficher le rapport
Tutoriel malwarebytes : http://www.pcinfo-web.com/
Et afficher également un rapport HijackThis -
Contributeur sécuritéavrel cit : Bonjour tu as de la chance g reparer un ordi infecter par ca hier
Si tu n as pas utilisé malwarebytes, l ordi que tu as réparé n est pas vraiment réparé lol -
Pfff Encors un qui croit tout savoire lol
-
Contributeur sécuritéJe ne crois pas tout savoir mais je connais beaucoup de choses c est vrai ;-)
-
Contributeur sécuritécvs87 : il vaudrait mieux que tu fasses d abord un rapport hijackthis avant de faire malwarebytes, il faut peut etre exécuter d autres programmes de désinfection avant...
-
Ah bon alors tu dois savoir qu’Antivirus XP 2008 est un virus avec un spyware
-
Contributeur sécuritéantivirus XP 2008 est un rogue (un faux logiciel de protection) et il faut utiliser d autres programmes avant malwarebytes...
-
Heureusement que il faut d’autre programmes SpyBot A2 Free et AVG 8 suffisent
-
Contributeur sécuritémdr...est ce que tu sais lire un rapport hijackthis ??
-
Voici le rapport HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:36:13, on 13/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\pphc1n4j0ep6r.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Wanadoo\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SMrhc5n4j0ep6r] C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
-
HijackThis sert a indiquer les infection oublier et encor pressant
-
-
-
Contributeur sécurité@buginformatikmerci pour l intervention et ta précision sur sa vision buginformatik lol ;-)
-
Contributeur
-
-
Contributeur sécuritéCommence par faire ceci stp :
Option 1 - Recherche :
télécharge smitfraudfix et enregistre le sur le bureau à cette adresse (c est le numéro 2 en bas de la page) :
https://www.androidworld.fr/
Ensuite double clique sur smitfraudfix puis exécuter
Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.
copier/coller le rapport dans la réponse. -
Contributeur sécuritéTu as le virus braviax aussi...on va s en occuper ;-)
-
Voici le rapport smitfraudfix:
SmitFraudFix v2.336
Rapport fait à 12:02:26,09, 13/08/2008
Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\pphc1n4j0ep6r.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Wanadoo\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHATEA~1\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 81.253.149.9
DNS Server Search Order: 80.10.246.132
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Merci -
Contributeur sécuritéc est ok...
tu peux faire malwarebytes comme t avais demandé mido ici :
http://www.commentcamarche.net/forum/affich 7875438 probleme antivirus xp 2008#3 -
Voici le rapport malwarebytes:
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1047
Windows 5.1.2600 Service Pack 2
13:14:36 13/08/2008
mbam-log-8-13-2008 (13-14-36).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 64753
Temps écoulé: 49 minute(s), 58 second(s)
Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 18
Fichier(s) infecté(s): 49
Processus mémoire infecté(s):
C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Unloaded process successfully.
C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Delete on reboot.
C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.
C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhc5n4j0ep6r (Rogue.Multiple) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpsr (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\WINDOWS\system32\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\data (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\install.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\XPSecurityCenter.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000436.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000442.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000449.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000455.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP11\A0000567.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000365.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000366.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000377.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000383.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000406.exe (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\F1.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\F2.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\F7.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winivstr.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wsnpoem\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\htmlayout.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\pthreadVC2.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\un.ico (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\unzip32.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\wscui.cpl (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\XP_SecurityCenter.cfg (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\data\daily.cvd (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcm80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcp80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcr80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc5n4j0ep6r\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphc1n4j0ep6r.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phc1n4j0ep6r.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\XPSecurityCenter.lnk (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chateau Magneau\Cookies\qiqyqopepy.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
Merci -
Merci, je n'ai plus d'autre manipulations à faire?
-
Contributeur sécuritéSalut cvs87 ...
juste une petite intrusion ...
On avais pourtant (presque) terminé ensemble il y a peut avec ce prb :
http://www.commentcamarche.net/forum/affich 7637664 probleme xp security center#1
--> comment as tu pu de refaire piéger si peut de temps après ??? o-0'
Bonne chance ... il reste encore du travail ...
-
-
Contributeur sécuritérefais un nouveau rapport hijackthis stp cvs87
