Virus dans mon pc

Résolu
AKHRAZ -  
Bonjour,
je me permets de vous demander de bien vouloir m'aider à resoudre ce probléme que j'ai avec mon PC:
l'écran est devenue blanche et il est affiché dedans deux messages qui ne partent pas:
- Waring!Win32/Adware.virtumonde.Detected on your computer Danger
- Waring!Win32/PrivacyRemover.M64 Detected on your computer Danger
qu'est ce que je dois faire?
Merci pour votre aide
Configuration: Windows XP
Internet Explorer 6.0

48 réponses

Résumé de la discussion

Des messages d’alerte persistants indiquent la détection de malware Win32/Adware.virtumonde et Win32/PrivacyRemover sur un PC Windows XP, et l’écran devient blanc sans que les messages disparaissent. Plusieurs solutions proposées consistent à réaliser un scan complet avec un logiciel anti-malware et à nettoyer les éléments persistant dans le registre, puis à relancer une analyse avec un outil dédié. Les rapports d’outils tels que Malwarebytes indiquent la mise en quarantaine et la suppression de clés de registre malicieuses et de dossiers infectés, renforçant le nettoyage et la sécurité du système. En cas de doutes, certains préconisent d’effectuer un second scan avec un cleaner dédié et de vérifier les éléments de restauration système ayant été concernés par les infections.

Bobot (l’IA à votre service)
  2. AKHRAZ Auteur
    d'accord.je te remercie beaucoup pour tes conseils judicieux qui m'ont permis de resoudre les gros problémes que mon PC a connu.bonne soirée
    1. E..T Contributeur
      Bon et bien si tu n'as plus de soucis tu peux mettre en résolu.
      @+
      4. AKHRAZ Auteur
        bonsoir
        voila le rapport d'analyse de mo antivirus.MERCI

        Avira AntiVir Personal
        Report file date: mardi 30 septembre 2008 17:11

        Scanning for 1649801 virus strains and unwanted programs.

        Licensed to: Avira AntiVir PersonalEdition Classic
        Serial number: 0000149996-ADJIE-0001
        Platform: Windows XP
        Windows version: (Service Pack 2) [5.1.2600]
        Boot mode: Normally booted
        Username: SYSTEM
        Computer name: HOME-A24B9844FE

        Version information:
        BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
        AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
        AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
        LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
        LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
        ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
        ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
        ANTIVIR2.VDF : 7.0.6.217 3773440 Bytes 26/09/2008 11:34:42
        ANTIVIR3.VDF : 7.0.6.225 64512 Bytes 29/09/2008 07:11:46
        Engineversion : 8.1.1.35
        AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
        AESCRIPT.DLL : 8.1.0.76 319867 Bytes 18/09/2008 16:18:37
        AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
        AERDL.DLL : 8.1.1.2 438644 Bytes 18/09/2008 16:18:37
        AEPACK.DLL : 8.1.2.3 364918 Bytes 24/09/2008 11:28:26
        AEOFFICE.DLL : 8.1.0.25 196986 Bytes 18/09/2008 16:18:36
        AEHEUR.DLL : 8.1.0.59 1438071 Bytes 18/09/2008 16:18:35
        AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
        AEGEN.DLL : 8.1.0.36 315764 Bytes 16/09/2008 16:15:50
        AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
        AECORE.DLL : 8.1.1.11 172406 Bytes 16/09/2008 16:15:49
        AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
        AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
        AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
        AVREP.DLL : 8.0.0.2 98344 Bytes 16/09/2008 16:15:49
        AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
        AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
        AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
        SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
        SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
        NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
        RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
        RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

        Configuration settings for the scan:
        Jobname..........................: Complete system scan
        Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
        Logging..........................: low
        Primary action...................: interactive
        Secondary action.................: ignore
        Scan master boot sector..........: on
        Scan boot sector.................: on
        Boot sectors.....................: C:, D:,
        Process scan.....................: on
        Scan registry....................: on
        Search for rootkits..............: off
        Scan all files...................: Intelligent file selection
        Scan archives....................: on
        Recursion depth..................: 20
        Smart extensions.................: on
        Macro heuristic..................: on
        File heuristic...................: medium

        Start of the scan: mardi 30 septembre 2008 17:11

        The scan of running processes will be started
        Scan process 'avscan.exe' - '1' Module(s) have been scanned
        Scan process 'avcenter.exe' - '1' Module(s) have been scanned
        Scan process 'iexplore.exe' - '1' Module(s) have been scanned
        Scan process 'iexplore.exe' - '1' Module(s) have been scanned
        Scan process 'WINWORD.EXE' - '1' Module(s) have been scanned
        Scan process 'iexplore.exe' - '1' Module(s) have been scanned
        Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
        Scan process 'CLI.exe' - '1' Module(s) have been scanned
        Scan process 'CLI.exe' - '1' Module(s) have been scanned
        Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
        Scan process 'hposts08.exe' - '1' Module(s) have been scanned
        Scan process 'hpoevm08.exe' - '1' Module(s) have been scanned
        Scan process 'WZQKPICK.EXE' - '1' Module(s) have been scanned
        Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned
        Scan process 'hpohmr08.exe' - '1' Module(s) have been scanned
        Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
        Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
        Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
        Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
        Scan process 'jusched.exe' - '1' Module(s) have been scanned
        Scan process 'avgnt.exe' - '1' Module(s) have been scanned
        Scan process 'wcourier.exe' - '1' Module(s) have been scanned
        Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
        Scan process 'ATKOSD.exe' - '1' Module(s) have been scanned
        Scan process 'CLI.exe' - '1' Module(s) have been scanned
        Scan process 'HControl.exe' - '1' Module(s) have been scanned
        Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
        Scan process 'alg.exe' - '1' Module(s) have been scanned
        Scan process 'SbPFCl.exe' - '1' Module(s) have been scanned
        Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
        Scan process 'explorer.exe' - '1' Module(s) have been scanned
        Scan process 'svchost.exe' - '1' Module(s) have been scanned
        Scan process 'SbPFSvc.exe' - '1' Module(s) have been scanned
        Scan process 'SbPFLnch.exe' - '1' Module(s) have been scanned
        Scan process 'MDM.EXE' - '1' Module(s) have been scanned
        Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
        Scan process 'avguard.exe' - '1' Module(s) have been scanned
        Scan process 'sched.exe' - '1' Module(s) have been scanned
        Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
        Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
        Scan process 'svchost.exe' - '1' Module(s) have been scanned
        Scan process 'svchost.exe' - '1' Module(s) have been scanned
        Scan process 'svchost.exe' - '1' Module(s) have been scanned
        Scan process 'svchost.exe' - '1' Module(s) have been scanned
        Scan process 'svchost.exe' - '1' Module(s) have been scanned
        Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
        Scan process 'lsass.exe' - '1' Module(s) have been scanned
        Scan process 'services.exe' - '1' Module(s) have been scanned
        Scan process 'winlogon.exe' - '1' Module(s) have been scanned
        Scan process 'csrss.exe' - '1' Module(s) have been scanned
        Scan process 'smss.exe' - '1' Module(s) have been scanned
        51 processes with 51 modules were scanned

        Starting master boot sector scan:
        Master boot sector HD0
        [INFO] No virus was found!
        Master boot sector HD1
        [INFO] No virus was found!
        [WARNING] System error [21]: Le périphérique n'est pas prêt.

        Start scanning boot sectors:
        Boot sector 'C:\'
        [INFO] No virus was found!
        Boot sector 'D:\'
        [INFO] No virus was found!

        Starting to scan the registry.
        The registry was scanned ( '71' files ).

        Starting the file scan:

        Begin scan in 'C:\'
        C:\pagefile.sys
        [WARNING] The file could not be opened!
        Begin scan in 'D:\'

        End of the scan: mardi 30 septembre 2008 17:46
        Used time: 35:05 Minute(s)

        The scan has been done completely.

        4567 Scanning directories
        292163 Files were scanned
        0 viruses and/or unwanted programs were found
        0 Files were classified as suspicious:
        0 files were deleted
        0 files were repaired
        0 files were moved to quarantine
        0 files were renamed
        1 Files cannot be scanned
        292162 Files not concerned
        1204 Archives were scanned
        2 Warnings
        0 Notes
        1. AKHRAZ Auteur
          je vais refaire l'analyse et je t'enverrai le rapport complet.merci
          1. E..T Contributeur
            Salut,
            Ca va merci ;-)
            Et le nom des virus qu'il t'a trouvé c'est quoi tu as cherché sur le net ?
            Sinon envoie les.
            @++
            1. AKHRAZ Auteur
              Bonjour
              j'espére que tu vas bien mon cher ami.
              je veux juste t'informer que j'ai fait une analyse compléte de mon antivirus et il detecte 2 warnings.je sais pas d'ou ça vient.merci
              1. AKHRAZ Auteur
                resalut
                j'ai lancé une recherche sur tools cleaner mais il ne me donne plus rien.je pense que tout est supprimé.enfin je sais pas. merci
                1. E..T Contributeur
                  Salut,
                  Refais un scan avec tools cleaner pour voir si tout est supprimé.
                  ++
                  1. AKHRAZ Auteur
                    bonjour
                    je pense que j'ai appuyé sur une touche que j'ai pas du et le rapport est supprimé car dans la racine de disque C de mon pc il n'est plus que celui que je t'ai envoyé.or,c'est un rapport que j'ai récupéré aprés le deuxième scan de CCleaner.merci cher ami
                    2. AKHRAZ Auteur
                      bonjour
                      voila le rapport ToolsCleaner que j'ai trouvé dans la racine du disque C de mon pc.
                      pour les logiciels qu'on a utilisé tout est supprimé.merc

                      [ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

                      -->- Recherche:

                      ---------------------------------
                      -->- Suppression:
                      1. E..T Contributeur
                        Bonsoir,
                        A la racine de ton disque C tu es allé voir si il n'y es pas c'est bizarre... ;) >>> TCleaner.txt
                        Regarde si il y encore les logiciels que l'on a utilisé ? Si ils n'y sont plus c'est ok !
                        Tu peux mettre le topic en résolu.
                        @++
                        1. AKHRAZ Auteur
                          bonsoir cher ami
                          d'abord je tiens à te remercier pour tes conseils judicieuses qui m'ont permis desinfecter mon PC.
                          Pour les programmes que tu m'avais conseillé je l'ai installé et j'ai supprimé les vieux par contre j'ai pas eu le rapport de oolsCleaner.quand j'ai fait "quitter" il me l'a pas donné.mais je sais pas si je devrai encore faire qque chose.je te remercie beaucoup.
                          1. E..T Contributeur
                            Salut AKHRAZ,
                            Désolé pour la réponse tardive.

                            Ton rapport est nickel ;) mise à part des logiciels à mettre à jour.

                            il te faut un pare feu télécharges et installes Kerio, il est simple d'utilisation et efficace.
                            >> Ici pour télécharger
                            >> Tutoriel qui te permettra de le configurer correctement! >> https://www.vulgarisation-informatique.com/kerio.php

                            Pour compléter il te faut de l' antispyware utilise MalwareByte's Anti-Malware (by RubbeR DuckY)
                            Ici pour télécharger >> http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
                            Tuto d'installation et d'utilisation >> http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

                            //!!\\Très important//!!\
                            Met à jour internet explorer
                            >> https://support.microsoft.com/fr-fr/allproducts
                            Pourquoi le laisser à jour >> https://forum.malekal.com/viewtopic.php?f=45&t=12405&p=95936#p95936

                            Vérifie JAVA >> ICI c'est une chose importante aussi.
                            Installe la dernière version de adobe >> Ici

                            Une foi que les nouvelles versions sont installées virent les anciennes par ajouts suppressions de programmes ou par le programme de désinstallation.

                            Ensuite tu peux installer Ccleaner si tu ne l'as pas, c'est utilitaire de nettoyage gratuit permettant de garantir un respect de la vie privée en supprimant les fichiers d'historique et de cache du système.
                            >> Ici pour télécharger
                            >> Tuto complet
                            Pendant l'installation de Ccleaner dans les options d'installation >> décoche l'option de la barre d'outils Yahoo!

                            Et pour finir :

                            Télécharge ToolsCleaner il permet de supprimer les logiciels installés pendant la désinfection.
                            --> http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
                            # Clique sur Recherche et laisse le scan agir ...
                            # Clique sur Suppression pour finaliser.
                            # Tu peux, si tu le souhaites, te servir des Options facultatives.
                            # Clique sur Quitter pour obtenir le rapport.
                            # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

                            @++
                            1. AKHRAZ Auteur
                              bonjour
                              voici le rapport de HijackThis .il parait qu'il est réparé sinon il ya beaucoup d'amélioration.le fond d'ecran est revenu.merci beaucoup

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 17:50:03, on 18/09/2008
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                              C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                              C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                              C:\Program Files\Messenger\MSMSGS.EXE
                              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
                              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
                              C:\Program Files\WinZip\WZQKPICK.EXE
                              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
                              C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
                              C:\Program Files\Windows Live\Messenger\usnsvc.exe
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.uliege.be/cms/c_8699436/fr/portail-uliege
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                              O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                              O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                              O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe"
                              O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
                              O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
                              O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                              O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                              O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                              O4 - HKLM\..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe
                              O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                              O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                              O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
                              O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                              O4 - HKCU\..\Run: [VoipStunt] "C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
                              O4 - HKCU\..\Run: [OCAEBNDVDUpdate] C:\Program Files\ObjectCube\XXX2Burn DVD Wizard\xxx2burn.exe /update
                              O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                              O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
                              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                              O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              O4 - Global Startup: hp psc 1000 series.lnk = ?
                              O4 - Global Startup: hpoddt01.exe.lnk = ?
                              O4 - Global Startup: OFFICE One Startup v7.lnk = ?
                              O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                              O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                              O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                              O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                              O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                              O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                              O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                              O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                              O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe
                              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                              O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                              O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                              O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
                              O24 - Desktop Component 0: (no name) - http://imagineressources.linternaute.com/document/image/540/maison-mer-eternel-fira-santorin-873403.jpg
                              2. AKHRAZ Auteur
                                rebonjour
                                voila j'ai supprimer la slection et voici le rapport du scan merci

                                Malwarebytes' Anti-Malware 1.28
                                Version de la base de données: 1165
                                Windows 5.1.2600 Service Pack 2

                                18/09/2008 08:59:41
                                mbam-log-2008-09-18 (08-59-41).txt

                                Type de recherche: Examen complet (C:\|D:\|)
                                Eléments examinés: 107979
                                Temps écoulé: 38 minute(s), 5 second(s)

                                Processus mémoire infecté(s): 0
                                Module(s) mémoire infecté(s): 0
                                Clé(s) du Registre infectée(s): 1
                                Valeur(s) du Registre infectée(s): 11
                                Elément(s) de données du Registre infecté(s): 2
                                Dossier(s) infecté(s): 2
                                Fichier(s) infecté(s): 28

                                Processus mémoire infecté(s):
                                (Aucun élément nuisible détecté)

                                Module(s) mémoire infecté(s):
                                (Aucun élément nuisible détecté)

                                Clé(s) du Registre infectée(s):
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

                                Valeur(s) du Registre infectée(s):
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

                                Elément(s) de données du Registre infecté(s):
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

                                Dossier(s) infecté(s):
                                C:\Program Files\Microsoft Security Adviser (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Program Files\Accoona (Adware.Accoona) -> Quarantined and deleted successfully.

                                Fichier(s) infecté(s):
                                C:\Documents and Settings\Simo\Local Settings\Temp\170643437.exe (Malware.Trace) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP333\A0411196.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP333\A0412206.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP333\A0413198.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP333\A0414197.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP333\A0414232.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP333\A0414243.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP333\A0414263.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP334\A0415283.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\System Volume Information\_restore{58385911-2721-4BCA-9EC8-7893936A5060}\RP335\A0415304.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\WINDOWS\system32\blphc5c3j0e90r.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
                                C:\Program Files\Microsoft Security Adviser\mssadv_sp.log (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Program Files\Accoona\quiesce.exe (Adware.Accoona) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Simo\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                                • 1
                                • 2
                                • 3