resolu

luna30 · le 31 janvier 2007

bsr mon antivirus antivir a trouver ce virus ou trojan sur mon ordi comment faire aider moi svp merci bcp

Modifié le 4 février 2007 par luna30

bruce lee · le 31 janvier 2007

bonjour luna30 et bienvenue sur zebulon

telecharge la version original de hijackthis http://www.merijn.org/files/hijackthis.zip

déconnecte toi du net et installe le sur ton bureau

lance le en cliquant sur Do a system scan and save a logfile a la fin du scan le bloc note va s'ouvrir tu fais un copier coller de tout son contenu.

luna30 · le 31 janvier 2007

bsr mon antivirus antivir a trouver ce virus ou trojan sur mon ordi comment faire aider moi svp merci bcp

AntiVir PersonalEdition Classic

Report file date: mercredi 31 janvier 2007 20:27

Scanning for 658863 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: christophe

Computer name: SN302190040003

Version information:

BUILD.DAT : 217 12749 Bytes 05/12/2006 17:00:00

AVSCAN.EXE : 7.0.3.5 208936 Bytes 15/01/2007 16:10:41

AVSCAN.DLL : 7.0.3.1 35880 Bytes 13/12/2006 03:14:06

LUKE.DLL : 7.0.3.2 143400 Bytes 13/12/2006 03:14:07

LUKERES.DLL : 7.0.2.0 9256 Bytes 13/12/2006 03:14:07

ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 10:21:48

ANTIVIR1.VDF : 6.37.0.153 3131392 Bytes 12/01/2007 16:05:19

ANTIVIR2.VDF : 6.37.0.235 374784 Bytes 29/01/2007 16:47:46

ANTIVIR3.VDF : 6.37.1.8 56320 Bytes 31/01/2007 19:05:13

AVEWIN32.DLL : 7.3.1.33 2281984 Bytes 31/01/2007 19:05:15

AVPREF.DLL : 7.0.2.0 23592 Bytes 13/12/2006 03:14:06

AVREP.DLL : 6.37.1.1 1105960 Bytes 31/01/2007 19:05:14

AVRPBASE.DLL : 7.0.0.0 2162728 Bytes 30/03/2006 08:43:31

AVPACK32.DLL : 7.2.0.5 368680 Bytes 26/10/2006 13:26:10

AVREG.DLL : 7.0.1.2 30760 Bytes 15/01/2007 16:10:41

NETNT.DLL : 6.32.0.0 6696 Bytes 27/09/2005 07:56:49

RCIMAGE.DLL : 7.0.1.3 2097192 Bytes 13/12/2006 03:14:01

RCTEXT.DLL : 7.0.12.1 77864 Bytes 13/12/2006 03:14:01

Configuration settings for the scan:

Jobname..........................: Manual Selection

Configuration file...............: C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\PROFILES\folder.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: I:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: mercredi 31 janvier 2007 20:27

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Modules have been scanned

Scan process 'avcenter.exe' - '1' Modules have been scanned

Scan process 'avgnt.exe' - '1' Modules have been scanned

Scan process 'Watch.exe' - '1' Modules have been scanned

Scan process 'AlertModule.exe' - '1' Modules have been scanned

Scan process 'PollingModule.exe' - '1' Modules have been scanned

Scan process 'Inactivity.exe' - '1' Modules have been scanned

Scan process 'Toaster.exe' - '1' Modules have been scanned

Scan process 'ComComp.exe' - '1' Modules have been scanned

Scan process 'GestionnaireInternet.exe' - '1' Modules have been scanned

Scan process 'avgas.exe' - '1' Modules have been scanned

Scan process 'hprblog.exe' - '1' Modules have been scanned

Scan process 'hpqste08.exe' - '1' Modules have been scanned

Scan process 'alg.exe' - '1' Modules have been scanned

Scan process 'Residence.exe' - '1' Modules have been scanned

Scan process 'hpqtra08.exe' - '1' Modules have been scanned

Scan process 'TaskBarIcon.exe' - '1' Modules have been scanned

Scan process 'ctfmon.exe' - '1' Modules have been scanned

Scan process 'msmsgs.exe' - '1' Modules have been scanned

Scan process 'realsched.exe' - '1' Modules have been scanned

Scan process 'VM305_STI.exe' - '1' Modules have been scanned

Scan process 'hpwuSchd2.exe' - '1' Modules have been scanned

Scan process 'wdfmgr.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'slserv.exe' - '1' Modules have been scanned

Scan process 'FTRTSVC.exe' - '1' Modules have been scanned

Scan process 'CDAC11BA.EXE' - '1' Modules have been scanned

Scan process 'avguard.exe' - '1' Modules have been scanned

Scan process 'sched.exe' - '1' Modules have been scanned

Scan process 'spoolsv.exe' - '1' Modules have been scanned

Scan process 'explorer.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'lsass.exe' - '1' Modules have been scanned

Scan process 'services.exe' - '1' Modules have been scanned

Scan process 'winlogon.exe' - '1' Modules have been scanned

Scan process 'csrss.exe' - '1' Modules have been scanned

Scan process 'smss.exe' - '1' Modules have been scanned

41 processes with 41 modules were scanned

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'F:\'

[NOTE] In the drive 'F:\' no data medium is inserted!

Boot sector 'G:\'

[NOTE] In the drive 'G:\' no data medium is inserted!

Boot sector 'H:\'

[NOTE] In the drive 'H:\' no data medium is inserted!

Boot sector 'I:\'

[NOTE] In the drive 'I:\' no data medium is inserted!

Starting to scan the registry.

The registry was scanned ( 26 files ).

Starting the file scan:

Begin scan in 'C:\' <HDD>

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\APPS\RecordNow\Disk1.CAB

[0] Archive type: CAB (Microsoft)

--> stax.exe.291CE843_86A0_4ED1_B843_C9720B19B025

[DETECTION] Is the Trojan horse TR/Spy.Banker.cel.1

[iNFO] The file was moved to '4633f161.qua'!

C:\Program Files\Sonic\Express Labeler\stax.exe

[DETECTION] Is the Trojan horse TR/Spy.Banker.cel.1

[iNFO] The file was moved to '4621f863.qua'!

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP314\A0039325.exe

[DETECTION] Is the Trojan horse TR/Spy.Banker.cel.1

[iNFO] The file was moved to '45f0f8e6.qua'!

Begin scan in 'D:\' <060831_0718>

Begin scan in 'E:\'

The path E:\ could not be found!