virus w32 gen other Résolu/Fermé

Question

Bonsoir,

Avast a détecté début du week-end le Trojan W32 gen other. J'ai fait un bilan avec hijackthis et voici le résultat je ne sais pas comment l'interpréter. 
Je déjà fait un démarrage avec un mode sans echec puis active cccleaner mais toujours le problème .
 Help !
quelqu'un peut-il m'aider  svp?


Logfile of HijackThis v1.99.1
Scan saved at 16:36:03, on 19/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\FotoStation Easy\FotoStation Easy AutoLaunch.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\FAMILLE\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/french
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB002" /M "Stylus Photo R240"
O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P40 "EPSON Stylus Photo R240 Series (Copie 1)" /O6 "USB003" /M "Stylus Photo R240"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: FotoStation Easy AutoLaunch.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114878208316
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - https://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe


que dois-je faire  ?
MErci d'avance

jlpjlp · Accepted Answer

cela est dans poste de travail puis C puis otmovit puis moved file : vire ce qui est dans movedfile et cela sera supprimé de ton ordi 




encore des soucis????

jlpjlp · Answer

slt
scan avec malwarebyte et colle le rapport:

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 

_______________________
/puis fait un scan en ligne avec un des suivants: et colle le rapport)


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

kaspersky en ligne :
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

jlpjlp · Answer

pour bitdefender il faut faire un scan en ligne et pas  télécharger la version bitdefender

jlpjlp · Answer

tu as bien viré ce qui a été trouvé????????

A.pencoat · Answer

Bonsoir,


Je les ai viré dans un deuxième temps voici le rapport, en faite ce soir, car pas eu le temps ce matin.
En plus bit defender c'est planté car coupure de mail....
je viens de le relancer ùais, je pense qu'il va tourner qlq hrs.
Je te tiens au courant  + tard ce soir.

Malwarebytes' Anti-Malware 1.29
Version de la base de données: 1290
Windows 5.1.2600 Service Pack 3

20/10/2008 20:03:02
mbam-log-2008-10-20 (20-03-02).txt

Type de recherche: Examen complet (C:\|H:\|)
Eléments examinés: 188190
Temps écoulé: 8 hour(s), 49 minute(s), 4 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 27

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\ScanSpyware v3.8.0.2 (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\log (Rogue.ScanSpyware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\FAMILLE
 (Trojan.Downloader) -> Quarantined and deleted successfully.
H:\Program Files\HbTools\Bin\4.7.1.0\dBenderC.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\baBackupRestore.dll (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\pests11-10-04.db (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\Scanner.exe (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\Scanner.exe.bak (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\ScanSpyware.url (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\ssdb022908.db (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\ssdb031108.db (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\undelete.log (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\unins000.dat (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\unins000.exe (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\log\1-3-2008 (16-33-13).log (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\log\10-3-2008 (19-12-32).log (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\log\11-4-2008 (22-31-36).log (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\log\18-10-2008 (7-55-48).log (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\Program Files\ScanSpyware v3.8.0.2\log\2-3-2008 (1-22-45).log (Rogue.ScanSpyware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcpcmj0evfe.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\FAMILLE\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.


a+

jlpjlp · Answer

ok a plus

A.pencoat · Answer

Salut,


Me voilà de retour, j' ai eu des difficultés avec bit defender, il a planté 3 fois a cause de déconnection d'internet. Finalement j'ai fait panda dont voici les rapport :

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-10-22 10:03:51
PROTECTIONS: 1
MALWARE: 7
SUSPECTS: 4
;******************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;=====================================================================
avast! antivirus 4.8.1229 [VPS 081021-0]     4.8.1229                      Yes       Yes
;======================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;======================================================================
00045226  W97M/Relax                         Virus               No        0         Yes            No           H:\Documents and Settings\FAMILLE\Mes documents\BOULOT\AAA- Bernard - Dossiers\Client\P&G\Charmin\Charmin Validation\Charmin DACH launch forecast validation (Novaction).zip[Artwork change test (revised claim on pack).zip][CMK perspective new ply communication.doc]

00045226  W97M/Relax                         Virus               No        0         Yes            No           H:\dossier perso 20-02\AAA- Bernard - Dossiers\Client\P&G\Charmin\Charmin Validation\Charmin DACH launch forecast validation (Novaction).zip[Artwork change test (revised claim on pack).zip][CMK perspective new ply communication.doc]

00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\FAMILLE\Cookies\famille@atdmt[2].txt

00162399  HackTool/EvID4226                  HackTools           No        0         Yes            No           C:\Program Files\eMule\EvID4226Patch.exe

00162399  HackTool/EvID4226                  HackTools           No        0         Yes            No           H:\Program Files\eMule\EvID4226Patch.exe

00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\FAMILLE\Cookies\famille@xiti[1].txt

00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\FAMILLE\Cookies\famille@weborama[1].txt

03899058  Generic Malware                    Virus/Trojan        No        0         No             No           H:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 1.0.0.86\AppleMobileDeviceSupport.msi[unk_0048][OutlookSyncAlertTool.exe]

03899058  Generic Malware                    Virus/Trojan        No        0         No             No           C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 1.0.0.86\AppleMobileDeviceSupport.msi[unk_0048][OutlookSyncAlertTool.exe]

03906245  Generic Malware                    Virus/Trojan        No        0         Yes            No           H:\Program Files\ShopperReports\Uninstall.exe
;======================================================================

SUSPECTS
Sent      Location    4
;======================================================================
No        C:\Documents and Settings\FAMILLE\Bureau\SmitfraudFix\404Fix.exe                                                                                                                     4
No        C:\Documents and Settings\FAMILLE\Bureau\SmitfraudFix\AntiXPVSTFix.exe                                                                                                                4
No        C:\Documents and Settings\FAMILLE\Bureau\SmitfraudFix\IEDFix.C.exe                                                                                                                    4
No        C:\Documents and Settings\FAMILLE\Local Settings\Temp\bauhvjgn.exe                                                                                                                                                 4
=======================================================================VULNERABILITIES
Id        Severity   Description            4
;======================================================================


j'ai pu desinfecté seulement celui ci :
03906245  Generic Malware                    Virus/Trojan        No        0         Yes            No           H:\Program Files\ShopperReports\Uninstall.exe


que dois-je faire pour le reste?

Merci d'avance

A+

jlpjlp · Answer

8 15:41:56  
Voter pour ce message


télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :


H:\Documents and Settings\FAMILLE\Mes documents\BOULOT\AAA- Bernard - Dossiers\Client\P&G\Charmin\Charmin Validation\Charmin DACH launch forecast validation (Novaction).zip
H:\dossier perso 20-02\AAA- Bernard - Dossiers\Client\P&G\Charmin\Charmin Validation\Charmin DACH launch forecast validation (Novaction).zip
C:\Program Files\eMule\EvID4226Patch.exe
H:\Program Files\eMule\EvID4226Patch.exe
H:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 1.0.0.86\AppleMobileDeviceSupport.msi
C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 1.0.0.86\AppleMobileDeviceSupport.msi
H:\Program Files\ShopperReports\Uninstall.exe
C:\Documents and Settings\FAMILLE\Bureau\SmitfraudFix\404Fix.exe 4
C:\Documents and Settings\FAMILLE\Bureau\SmitfraudFix\AntiXPVSTFix.exe 4
C:\Documents and Settings\FAMILLE\Bureau\SmitfraudFix\IEDFix.C.exe 4
C:\Documents and Settings\FAMILLE\Local Settings\Temp\bauhvjgn.exe 4


clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

jlpjlp · Answer

pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

(AVAST en français)   ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT 

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware ont sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus  touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

Virus w32 gen other

9 réponses

Discussions similaires