Probléme Antivirus XP 2008

cvs87 -  
Bonjour,

j'ai le logiciel Antivirus XP 2008 qui m'a infecté, que dois-je faire?

Cordialement
cvs87
Configuration: Windows XP
Firefox 2.0.0.16

20 réponses

Résumé de la discussion

Une infection par Antivirus XP 2008 est signalée et demande des conseils concrets pour nettoyer un système Windows XP et supprimer le spyware associé présent. Plusieurs recommandations privilégient des outils de détection et de désinfection tels que SpyBot A2 Free et AVG 8, avec l’important rappel de maintenir les navigateurs à jour. D'autres suggèrent d'effectuer un rapport HijackThis et d'exécuter Malwarebytes, parfois après une étape initiale de nettoyage complémentaire et la désactivation temporaire de certains modules malveillants. En cas de doute, certains rappellent qu’Antivirus XP 2008 est un logiciel malveillant combinant virus et spyware, nécessitant une approche pluridisciplinaire et une vérification approfondie du système.

Bobot (l’IA à votre service)
  1. geoffrey5 Contributeur sécurité
    refais un nouveau rapport hijackthis stp cvs87
    0
    2. cvs87 Auteur
      Voici le rapport malwarebytes:

      Malwarebytes' Anti-Malware 1.24
      Version de la base de données: 1047
      Windows 5.1.2600 Service Pack 2

      13:14:36 13/08/2008
      mbam-log-8-13-2008 (13-14-36).txt

      Type de recherche: Examen complet (C:\|)
      Eléments examinés: 64753
      Temps écoulé: 49 minute(s), 58 second(s)

      Processus mémoire infecté(s): 2
      Module(s) mémoire infecté(s): 3
      Clé(s) du Registre infectée(s): 4
      Valeur(s) du Registre infectée(s): 6
      Elément(s) de données du Registre infecté(s): 3
      Dossier(s) infecté(s): 18
      Fichier(s) infecté(s): 49

      Processus mémoire infecté(s):
      C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Unloaded process successfully.
      C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Unloaded process successfully.

      Module(s) mémoire infecté(s):
      C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Delete on reboot.
      C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.
      C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\rhc5n4j0ep6r (Rogue.Multiple) -> Delete on reboot.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpsr (Rootkit.Agent) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

      Dossier(s) infecté(s):
      C:\WINDOWS\system32\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\data (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\NetworkService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\LocalService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\rhc5n4j0ep6r\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\pphc1n4j0ep6r.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\install.exe (Rogue.Installer) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\XPSecurityCenter.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000436.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000442.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000449.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP10\A0000455.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP11\A0000567.exe (Rogue.Installer) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000365.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000366.exe (Rogue.Installer) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000377.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000383.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{92A2F0FD-012D-4BAE-A467-56FD2B889C5B}\RP9\A0000406.exe (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\F1.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\F2.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\F7.tmp (Rogue.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\winivstr.exe (Rogue.Installer) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\wsnpoem\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\htmlayout.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\pthreadVC2.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\un.ico (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\unzip32.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\wscui.cpl (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\XP_SecurityCenter.cfg (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\data\daily.cvd (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcm80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcp80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcr80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5n4j0ep6r\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\blphc1n4j0ep6r.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\phc1n4j0ep6r.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
      C:\Documents and Settings\All Users\Bureau\XPSecurityCenter.lnk (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Chateau Magneau\Cookies\qiqyqopepy.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

      Merci
      0
      3. cvs87 Auteur
        Voici le rapport smitfraudfix:

        SmitFraudFix v2.336

        Rapport fait à 12:02:26,09, 13/08/2008
        Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
        OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
        Le type du système de fichiers est NTFS
        Fix executé en mode normal

        »»»»»»»»»»»»»»»»»»»»»»»» Process

        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
        C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
        C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
        C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Wanadoo\GestionnaireInternet.exe
        C:\Program Files\Wanadoo\ComComp.exe
        C:\PROGRA~1\Wanadoo\Toaster.exe
        C:\PROGRA~1\Wanadoo\Inactivity.exe
        C:\PROGRA~1\Wanadoo\PollingModule.exe
        C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
        C:\WINDOWS\system32\pphc1n4j0ep6r.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Wanadoo\Watch.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
        C:\WINDOWS\system32\cmd.exe

        »»»»»»»»»»»»»»»»»»»»»»»» hosts

        »»»»»»»»»»»»»»»»»»»»»»»» C:\

        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

        »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau

        »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chateau Magneau\Application Data

        »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

        »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHATEA~1\Favoris

        »»»»»»»»»»»»»»»»»»»»»»»» Bureau

        »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

        »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

        »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

        »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

        IEDFix
        Credits: Malware Analysis & Diagnostic
        Code: S!Ri

        »»»»»»»»»»»»»»»»»»»»»»»» VACFix
        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

        VACFix
        Credits: Malware Analysis & Diagnostic
        Code: S!Ri

        »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

        404Fix
        Credits: Malware Analysis & Diagnostic
        Code: S!Ri

        »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

        SrchSTS.exe by S!Ri
        Search SharedTaskScheduler's .dll

        »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
        "AppInit_DLLs"=""

        »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
        "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe,"
        "System"=""

        »»»»»»»»»»»»»»»»»»»»»»»» Rustock

        »»»»»»»»»»»»»»»»»»»»»»»» DNS

        Description: WAN (PPP/SLIP) Interface
        DNS Server Search Order: 81.253.149.9
        DNS Server Search Order: 80.10.246.132

        HKLM\SYSTEM\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132
        HKLM\SYSTEM\CS1\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer=81.253.149.9 80.10.246.132

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

        »»»»»»»»»»»»»»»»»»»»»»»» Fin

        Merci
        0
        1. geoffrey5 Contributeur sécurité
          Tu as le virus braviax aussi...on va s en occuper ;-)
          0
          1. geoffrey5 Contributeur sécurité
            Commence par faire ceci stp :

            Option 1 - Recherche :

            télécharge smitfraudfix et enregistre le sur le bureau à cette adresse (c est le numéro 2 en bas de la page) :

            https://www.androidworld.fr/

            Ensuite double clique sur smitfraudfix puis exécuter

            Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

            copier/coller le rapport dans la réponse.
            0
            1. avrel820
              HijackThis sert a indiquer les infection oublier et encor pressant
              0
              1. geoffrey5 Contributeur sécurité
                les infections oubliées ?! ^^
                0
              2. buginformatik Contributeur
                avrel820, au lieu de polluer le post de cvs87 et geoffrey5 tu voudrais pas "aider" des gens sans réponses ?

                De plus je trouve ta vision d'hijackthis un peu bateau

                Mais cela n'engage que moi

                ++
                0
              3. geoffrey5 Contributeur sécurité
                @buginformatikmerci pour l intervention et ta précision sur sa vision buginformatik lol ;-)
                0
              4. buginformatik Contributeur
                @geoffrey5J'ai dû mal à voir si c'est ironique ou pas

                XD
                0
            2. cvs87 Auteur
              Voici le rapport HijackThis:

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 11:36:13, on 13/08/2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16674)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
              C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
              C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
              C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Wanadoo\GestionnaireInternet.exe
              C:\Program Files\Wanadoo\ComComp.exe
              C:\PROGRA~1\Wanadoo\Toaster.exe
              C:\PROGRA~1\Wanadoo\Inactivity.exe
              C:\PROGRA~1\Wanadoo\PollingModule.exe
              C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
              C:\WINDOWS\system32\pphc1n4j0ep6r.exe
              C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Wanadoo\Watch.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\Program Files\Mozilla Firefox\firefox.exe
              C:\HJT.exe

              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
              F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
              O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
              O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
              O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
              O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
              O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
              O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
              O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
              O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
              O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
              O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
              O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
              O4 - HKLM\..\Run: [SMrhc5n4j0ep6r] C:\Program Files\rhc5n4j0ep6r\rhc5n4j0ep6r.exe
              O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
              O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
              O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{FD47EA33-D979-48D2-9D4A-6743E1074A4C}: NameServer = 80.10.246.130 81.253.149.10
              O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
              O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
              0
              1. geoffrey5 Contributeur sécurité
                mdr...est ce que tu sais lire un rapport hijackthis ??
                0
                1. avrel820
                  Heureusement que il faut d’autre programmes SpyBot A2 Free et AVG 8 suffisent
                  0
                  1. geoffrey5 Contributeur sécurité
                    antivirus XP 2008 est un rogue (un faux logiciel de protection) et il faut utiliser d autres programmes avant malwarebytes...
                    0
                    1. avrel820
                      Ah bon alors tu dois savoir qu’Antivirus XP 2008 est un virus avec un spyware
                      0
                      1. geoffrey5 Contributeur sécurité
                        cvs87 : il vaudrait mieux que tu fasses d abord un rapport hijackthis avant de faire malwarebytes, il faut peut etre exécuter d autres programmes de désinfection avant...
                        0
                        1. geoffrey5 Contributeur sécurité
                          Je ne crois pas tout savoir mais je connais beaucoup de choses c est vrai ;-)
                          0
                          1. avrel820
                            Pfff Encors un qui croit tout savoire lol
                            0
                            1. geoffrey5 Contributeur sécurité
                              avrel cit : Bonjour tu as de la chance g reparer un ordi infecter par ca hier

                              Si tu n as pas utilisé malwarebytes, l ordi que tu as réparé n est pas vraiment réparé lol
                              0
                              1. mido
                                cvs87,

                                Telecharger malwarebytes : http://www.malwarebytes.org/mbam/program/mbam-setup.exe

                                Installer / màj, lancer un scan complet et supprimer toute les infections trouvés.
                                Afficher le rapport

                                Tutoriel malwarebytes : http://www.pcinfo-web.com/

                                Et afficher également un rapport HijackThis
                                0
                                1. avrel820
                                  mido j'espere que malwarebytes s'aucupe de viruses et de spywear
                                  0
                              2. avrel820
                                Bonjour tu as de la chance g reparer un ordi infecter par ca hier
                                0
                                1. geoffrey5 Contributeur sécurité
                                  Salut !!

                                  Télécharge hijackthis à cette adresse, tout est expliqué pour bien l installer et pour savoir s'en servir :

                                  https://www.androidworld.fr/
                                  0

                                  Discussions similaires

                                  Ou trouver le pilote pour epson xp-2205
                                  lutttinette

                                  19 réponses
                                  probleme configuration wifi epson xp-225
                                  sam099

                                  35 réponses
                                  Google Chrome "  Échec de l'analyse antivirus "
                                  jmpower

                                  18 réponses