Infection par Xor-encoded.A et autres...

Question

Bonjour,

Mon ordi semble infecté par plusieurs "choses" dont Xor-encoded.A, voici le rapport de Activescan 2.0. Après avoir vu ça pouvez-vous me dire si vous pouvez m'aider ?

Merci beaucoup !!!!!




;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-09-07 02:01:34
PROTECTIONS: 1
MALWARE: 24
SUSPECTS: 9
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Windows Defender                             1.1.3903.0                    No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@doubleclick[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@atdmt[2].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@tradedoubler[1].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@247realmedia[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@fastclick[2].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@mediaplex[2].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@xiti[1].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@statcounter[2].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@ad.yieldmanager[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@ad.yieldmanager[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@apmebf[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@weborama[2].txt
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@advertising[2].txt
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@media.adrevolver[3].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@overture[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@zedo[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@bluestreak[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@bluestreak[2].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@adrevolver[2].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@adrevolver[2].txt
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@adultfriendfinder[2].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@smartadserver[2].txt
02990320  Application/BoontyGames            HackTools           No        0         Yes            No           C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
03009106  W32/Xor-encoded.A                  Virus               No        0         No             No           C:\Users\marie\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report0ad165c4\Report.cab[tuvvTNhe.dll.xor]
03281648  Trj/Lineage.BZE                    Virus/Trojan        No        1         Yes            No           C:\Program Files\Dress Shop Hop\Uninstall.exe
03600161  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp\fkpbrmmn.dll
03600161  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp\vdkxprao.dll
03600564  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp\opnkKaXn.dll
03600564  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp	uvWomNh.dll
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              &#65533;+YR@&#65533;Ms5
;===================================================================================================================================================================================
No        C:\Users\marie\AppData\Local\Temp\koywaidj.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\blbbfjey.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\geBuRKcA.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\hlgrftym.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\jkkIYrOI.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\khFUKbaX.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\koywaidj.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\oPIcyaxY.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp	bsfyytq.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                &#65533;+YR@&#65533;Ms5
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Destrio5 · Answer

Salut,

Tu es infecté par Vundo aussi.

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

mimille1978 · Answer

Merci pour cette réponse rapide !

Et hop voici le scan !

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-09-07 02:01:34
PROTECTIONS: 1
MALWARE: 24
SUSPECTS: 9
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Windows Defender                             1.1.3903.0                    No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@doubleclick[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@atdmt[2].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@tradedoubler[1].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@247realmedia[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@fastclick[2].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@mediaplex[2].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@xiti[1].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@statcounter[2].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@ad.yieldmanager[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@ad.yieldmanager[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@apmebf[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@weborama[2].txt
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@advertising[2].txt
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@media.adrevolver[3].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@overture[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@zedo[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@bluestreak[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@bluestreak[2].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@adrevolver[2].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@adrevolver[2].txt
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\marie@adultfriendfinder[2].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Users\marie\AppData\Roaming\Microsoft\Windows\Cookies\Low\marie@smartadserver[2].txt
02990320  Application/BoontyGames            HackTools           No        0         Yes            No           C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
03009106  W32/Xor-encoded.A                  Virus               No        0         No             No           C:\Users\marie\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report0ad165c4\Report.cab[tuvvTNhe.dll.xor]
03281648  Trj/Lineage.BZE                    Virus/Trojan        No        1         Yes            No           C:\Program Files\Dress Shop Hop\Uninstall.exe
03600161  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp\fkpbrmmn.dll
03600161  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp\vdkxprao.dll
03600564  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp\opnkKaXn.dll
03600564  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\Users\marie\AppData\Local\Temp	uvWomNh.dll
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              &#65533;+YR@&#65533;Ms5
;===================================================================================================================================================================================
No        C:\Users\marie\AppData\Local\Temp\koywaidj.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\blbbfjey.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\geBuRKcA.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\hlgrftym.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\jkkIYrOI.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\khFUKbaX.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\koywaidj.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp\oPIcyaxY.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
No        C:\Users\marie\AppData\Local\Temp	bsfyytq.dll                                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;+YR@&#65533;Ms5
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                &#65533;+YR@&#65533;Ms5
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Destrio5 · Answer

Ce n'est pas le bon scan.

mimille1978 · Answer

Ah zut ! Comment dois-je faire pour avoir le bon scan SVP ?

Destrio5 · Answer

---> Fais un scan rapide avec MalwareByte's Anti-Malware, supprime tout ce qu'il trouve et poste le rapport.

Pour télécharger MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

mimille1978 · Answer

cETTE FOIS 9A DEVRAIT ËTRE BON;;;

Malwarebytes' Anti-Malware 1.26
Version de la base de données: 1103
Windows 6.0.6000 

07/09/2008 03:14:35
mbam-log-2008-09-07 (03-14-35).txt

Type de recherche: Examen rapide
Eléments examinés: 41680
Temps écoulé: 9 minute(s), 33 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm63df8f5e (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\60ecbcc2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\marie\AppData\Local\Temp\vdkxprao.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\marie\AppData\Local\Temp\koywaidj.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\marie\AppData\Local\Temp
nnkLcAp.dll (Malware.Trace) -> Quarantined and deleted successfully.

Destrio5 · Answer

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Désactive l'UAC le temps de la désinfection :
https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Destrio5 · Answer

Par contre, je dois te laisser.

mimille1978 · Answer

ça tombe bien moi aussi, je continuerai demain les yeux ouverts ! merci pour ton aide !!!

Destrio5 · Answer

- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

- Clique sur Install ensuite sur I Accept

- Clique sur Do a scan system and save log file

- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.

mimille1978 · Answer

Ah oui j'ai oublié de dire que je ne peux plus aller sur IE sur mon ordi (j'écris d'un autre) même si la connexion internet est bonne et je ne peux pas non plus me connecter sur msn depuis le scan combo.

Destrio5 · Answer

Regarde en bas de la page dans le lien suivant :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

mimille1978 · Answer

Il me met que Windows ne peut pas réparer automatiquement mais j'ai fait un "diagnostiquer" sur ma connexion wanadoo wifi qui m'indique "la carte réseau connexion sans fil n'a pas de configuration IP valide...

Destrio5 · Answer

Mince. 

Désinstalle et réinstalle ta clé wifi.

mimille1978 · Answer

Ma clé wifi doit être dans le portable il s'agit de atheros wireless network adaptater ?

Destrio5 · Answer

Marque et modèle du portable ?

mimille1978 · Answer

Peux-tu me rappeler s'il te plaît le nom du programme qui me permettra de te donner les infos sur mon ordi ? iceberg ou qque chose comme ça ? Je sais juste qu'il s'agit d'un asus X51R.

Destrio5 · Answer

Le logiciel s'appelle Everest.

Destrio5 · Answer

Tu as essayé de te déconnecter du wifi puis te reconnecter en remettant la clé wifi ?

mimille1978 · Answer

je me suis déconnectée plusieurs fois mais qd je me reconnecte il ne me la demande pas... J'y connais pas grand chose malheureusement !

Destrio5 · Answer

Tu as une livebox ?

mimille1978 · Answer

oui

Destrio5 · Answer

Appuie sur le bouton association de la livebox et essaie de te reconnecter.

Destrio5 · Answer

Installe ceci sur le Asus :
http://dlsvr04.asus.com/pub/ASUS/nb/X51/WLAN_Azurewave_AW-GE780_vista_070420.zip

mimille1978 · Answer

je n'ai pas réussi à télécharger ce fichier il y a un pb avec le zip mais j'ai résolu mon pb en attribuant adresse IP automatique.

je reprends là où j'ai arrêté la chasse aux virus...

mimille1978 · Answer

voici le log qu'en penses-tu ?...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:37, on 07/09/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\V0220Mon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Program Files\DivX\DivX Player\DivX Player.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [V0220Mon.exe] C:\Windows\V0220Mon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix: 
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fr-fr/wlscctrl2.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClient Control) - https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8692E58-CD63-4A61-9983-4F9EF3DC0683}: NameServer = 192.168.1.1
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

Destrio5 · Answer

Tu y tiens à Norton ?

mimille1978 · Answer

nan je suis censée l'avoir désinstaller lol

Destrio5 · Answer

Ok et a-squared, il te sert à quoi ?

mimille1978 · Answer

bah j'avais lu qque part que ça m'aiderait pour le cheval de troie mais moi je fais ce qu'on me dit lol

Destrio5 · Answer

---> Désinstalle a-squared

---> Désinstalle Norton avec ceci :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

---> Désinstalle Avast et installe Antivir (français et bien plus efficace) :
http://dl1.avgate.net/down/windows/antivir_workstation_winu_fr_h.exe

---> Fais un scan complet avec Antivir, supprime tout ce qu'il trouve et poste le rapport

mimille1978 · Answer

je te remercie pour ces nouveaux tuyaux, je crois qu'antivir n'a pas trouvé de virus, je n'a rien trouvé à supprimer :

AntiVir PersonalEdition Classic
Report file date: dimanche 7 septembre 2008 22:42

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows Vista
Windows version: (plain) [6.0.6000]
Username: SYSTEM
Computer name: PC-DE-MARIE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:26:55
ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 13:27:04
ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 13:27:13
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 16:43:56
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 7 septembre 2008 22:42

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'TrustedInstaller.exe' - '1' Module(s) have been scanned
Scan process 'WMIADAP.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'VSSVC.exe' - '1' Module(s) have been scanned
Scan process 'conime.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'NclRSSrv.exe' - '1' Module(s) have been scanned
Scan process 'NclUSBSrv.exe' - '1' Module(s) have been scanned
Scan process 'TosBtHSP.exe' - '1' Module(s) have been scanned
Scan process 'ServiceLayer.exe' - '1' Module(s) have been scanned
Scan process 'TosBtHid.exe' - '1' Module(s) have been scanned
Scan process 'TosA2dp.exe' - '1' Module(s) have been scanned
Scan process 'CCC.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'TosBtMng.exe' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'PCSuite.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'MOM.exe' - '1' Module(s) have been scanned
Scan process 'ATKOSD.exe' - '1' Module(s) have been scanned
Scan process 'ACEngSvr.exe' - '1' Module(s) have been scanned
Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'V0220Mon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'BatteryLife.exe' - '1' Module(s) have been scanned
Scan process 'ACMON.exe' - '1' Module(s) have been scanned
Scan process 'wcourier.exe' - '1' Module(s) have been scanned
Scan process 'ATKOSD2.exe' - '1' Module(s) have been scanned
Scan process 'HControl.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'sm56hlpr.exe' - '1' Module(s) have been scanned
Scan process 'ALU.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'TosBtSrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'InCDsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ASLDRSrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
87 processes with 87 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '14' files ).

Starting the file scan:

Begin scan in 'C:\' <VistaOS>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <DATA>

End of the scan: dimanche 7 septembre 2008 23:35
Used time: 53:07 min

The scan has been done completely.

17226 Scanning directories
213573 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
213573 Files not concerned
1493 Archives were scanned
2 Warnings
0 Notes

Destrio5 · Answer

Et avec Windows Defender ?

mimille1978 · Answer

Hello !

il n'a rien trouvé !

Destrio5 · Answer

Pardon, je parlais Activescan 2.0.

mimille1978 · Answer

L'analyse est bloquée à 88% et il y a déjà 40 fichiers infectés.

Destrio5 · Answer

Tu ne peux pas poster le rapport ?

mimille1978 · Answer

nan je relance le scan qui a planté.

mimille1978 · Answer

encore bloqué à 88%. ça peut venir du fichier scanné ? C:\Users\marie\Desktop\Co...882R2FWJFW\pv.cfexe

mimille1978 · Answer

je peux faire plutôt une analyse rapide ?

Destrio5 · Answer

Oui si tu veux.

mimille1978 · Answer

là le scan reste bloqué à 100% sans accès à un rapport avec 19 fichiers infectés.

Destrio5 · Answer

Comment faire si je n'ai pas le rapport.

Infection par Xor-encoded.A et autres... - Page 2

Discussions similaires

Newsletters