(RESOLU) Virus...

[kini1]

Bonsoir....

 

j'ai trouver 2 virus ....j'ai appliquer la procedure

je vous donne les rapports

 

un grand merci dejà de vous occuper de moi

 

voila le 1er antivirus mais j'avais mis les donnees en quarantaine

 

 

AntiVir PersonalEdition Classic

Report file date: 2007-11-09 15:44

 

Scanning for 923238 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Perso

Computer name: NOM-FAJKDOF30K5

 

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 05/11/2007 13:48:26

AVSCAN.DLL : 7.0.6.0 49192 Bytes 05/11/2007 13:48:26

LUKE.DLL : 7.0.5.3 147496 Bytes 05/11/2007 13:48:26

LUKERES.DLL : 7.0.6.1 10280 Bytes 05/11/2007 13:48:26

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:48:28

ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:48:28

ANTIVIR2.VDF : 7.0.0.172 1092608 Bytes 05/11/2007 06:49:46

ANTIVIR3.VDF : 7.0.0.196 102400 Bytes 09/11/2007 13:41:06

AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 08/11/2007 06:49:46

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:28

AVPREF.DLL : 7.0.2.2 25640 Bytes 05/11/2007 13:48:26

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 05/11/2007 13:48:28

AVREG.DLL : 7.0.1.6 30760 Bytes 05/11/2007 13:48:26

AVARKT.DLL : 1.0.0.20 278568 Bytes 05/11/2007 13:48:26

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 05/11/2007 13:48:26

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:44

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 05/11/2007 13:48:20

RCTEXT.DLL : 7.0.62.0 86056 Bytes 05/11/2007 13:48:20

SQLITE3.DLL : 3.3.17.1 339968 Bytes 05/11/2007 13:48:26

 

Configuration settings for the scan:

Jobname..........................: Local Drives

Configuration file...............: c:\program files\antivir personaledition classic\alldrives.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: H:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: medium

Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

 

Start of the scan: 2007-11-09 15:44

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'Explorer.EXE' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

12 processes with 12 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

Boot sector 'E:\'

[NOTE] No virus was found!

Boot sector 'F:\'

[NOTE] No virus was found!

Boot sector 'G:\'

[NOTE] No virus was found!

Boot sector 'A:\'

[NOTE] In the drive 'A:\' no data medium is inserted!

Boot sector 'I:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '22' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <WINXP_02C>

C:\PAGEFILE.SYS

[WARNING] The file could not be opened!

C:\ComboFix\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47a67a51.qua'!

C:\ComboFix\nircmd.cfexe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47a67a5e.qua'!

C:\fixwareout\FindT\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.2

[iNFO] The file was moved to '47a67a62.qua'!

Begin scan in 'D:\' <ANCIEN_C>

D:\Mes documents\Telechargement\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Reboot.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

--> SmitfraudFix\restart.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '479d7a97.qua'!

D:\Mes documents\Telechargement\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> ComboFixT\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47a17aab.qua'!

D:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075259.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

[iNFO] The file was moved to '47647a82.qua'!

D:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075261.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '47647a85.qua'!

D:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075272.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Reboot.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

--> SmitfraudFix\restart.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '47647a88.qua'!

D:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075273.exe

[0] Archive type: RAR SFX (self extracting)

--> ComboFixT\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47647a8d.qua'!

Begin scan in 'E:\' <WINXP_02D>

Begin scan in 'F:\' <RESTORE>

Begin scan in 'G:\' <ANCIEN_D>

G:\ancien_c (D)\Mes documents\Telechargement\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Reboot.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

--> SmitfraudFix\restart.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '479d7aeb.qua'!

G:\ancien_c (D)\Mes documents\Telechargement\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> ComboFixT\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47a17afe.qua'!

G:\ancien_c (D)\Mes documents\Telechargement\SmitfraudFix\Reboot.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

[iNFO] The file was moved to '47967af8.qua'!

G:\ancien_c (D)\Mes documents\Telechargement\SmitfraudFix\restart.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '47a77afb.qua'!

G:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075274.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Reboot.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

--> SmitfraudFix\restart.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '47647acd.qua'!

G:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075275.exe

[0] Archive type: RAR SFX (self extracting)

--> ComboFixT\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47647ad3.qua'!

G:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075276.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

[iNFO] The file was moved to '47647ad5.qua'!

G:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075277.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '47647ad7.qua'!

Begin scan in 'A:\'

Search path A:\ could not be opened!

Le périphérique n'est pas prêt.

 

Begin scan in 'I:\' <DOCUMENTS>

I:\William\Telechargement\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Reboot.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

--> SmitfraudFix\restart.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '479d7b29.qua'!

I:\William\Telechargement\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> ComboFixT\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47a17b47.qua'!

I:\William1\Telechargement\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Reboot.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Reboot.C program

--> SmitfraudFix\restart.exe

[DETECTION] Contains detection pattern of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '479d7b5f.qua'!

I:\William1\Telechargement\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> ComboFixT\nircmd.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was moved to '47a17b7b.qua'!

Begin scan in 'H:\'

Search path H:\ could not be opened!

Le périphérique n'est pas prêt.

 

 

 

End of the scan: 2007-11-09 16:21

Used time: 37:50 min

 

The scan has been done completely.

 

2418 Scanning directories

168813 Files were scanned

27 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

21 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

168786 Files not concerned

6491 Archives were scanned

1 Warnings

0 Notes

 

Le 2em scan toujours en mode sans echec

mais la j'ai mis supprimer

 

 

AntiVir PersonalEdition Classic

Report file date: 2007-11-09 16:55

 

Scanning for 923238 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Perso

Computer name: NOM-FAJKDOF30K5

 

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 05/11/2007 13:48:26

AVSCAN.DLL : 7.0.6.0 49192 Bytes 05/11/2007 13:48:26

LUKE.DLL : 7.0.5.3 147496 Bytes 05/11/2007 13:48:26

LUKERES.DLL : 7.0.6.1 10280 Bytes 05/11/2007 13:48:26

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:48:28

ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:48:28

ANTIVIR2.VDF : 7.0.0.172 1092608 Bytes 05/11/2007 06:49:46

ANTIVIR3.VDF : 7.0.0.196 102400 Bytes 09/11/2007 13:41:06

AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 08/11/2007 06:49:46

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:28

AVPREF.DLL : 7.0.2.2 25640 Bytes 05/11/2007 13:48:26

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 05/11/2007 13:48:28

AVREG.DLL : 7.0.1.6 30760 Bytes 05/11/2007 13:48:26

AVARKT.DLL : 1.0.0.20 278568 Bytes 05/11/2007 13:48:26

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 05/11/2007 13:48:26

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:44

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 05/11/2007 13:48:20

RCTEXT.DLL : 7.0.62.0 86056 Bytes 05/11/2007 13:48:20

SQLITE3.DLL : 3.3.17.1 339968 Bytes 05/11/2007 13:48:26

 

Configuration settings for the scan:

Jobname..........................: Local Drives

Configuration file...............: c:\program files\antivir personaledition classic\alldrives.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: H:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: medium

Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

 

Start of the scan: 2007-11-09 16:55

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgas.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'Explorer.EXE' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

14 processes with 14 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

Boot sector 'E:\'

[NOTE] No virus was found!

Boot sector 'F:\'

[NOTE] No virus was found!

Boot sector 'G:\'

[NOTE] No virus was found!

Boot sector 'A:\'

[NOTE] In the drive 'A:\' no data medium is inserted!

Boot sector 'I:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '22' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <WINXP_02C>

C:\PAGEFILE.SYS

[WARNING] The file could not be opened!

C:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075270.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.C

[iNFO] The file was deleted!

C:\System Volume Information\_restore{80F67991-5EE3-42F5-ACD0-85E44CAFF994}\RP273\A0075271.exe

[DETECTION] Contains detection pattern of the application APPL/NirCmd.2

[iNFO] The file was deleted!

Begin scan in 'D:\' <ANCIEN_C>

Begin scan in 'E:\' <WINXP_02D>

Begin scan in 'F:\' <RESTORE>

Begin scan in 'G:\' <ANCIEN_D>

Begin scan in 'A:\'

Search path A:\ could not be opened!

Le périphérique n'est pas prêt.

 

Begin scan in 'I:\' <DOCUMENTS>

Begin scan in 'H:\'

Search path H:\ could not be opened!

Le périphérique n'est pas prêt.

 

 

 

End of the scan: 2007-11-09 17:41

Used time: 45:11 min

 

The scan has been done completely.

 

2418 Scanning directories

168404 Files were scanned

2 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

2 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

168402 Files not concerned

6479 Archives were scanned

1 Warnings

0 Notes

 

voila...

 

puis le rapport Hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 17:45, on 2007-11-09

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\HijackThis\HijackThis.exe

C:\WINDOWS\system32\WgaTray.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netplus.ch/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [bDSwitchAgent] "C:\progra~1\softwin\bitdef~1\bdswitch.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: START_PAGE_URL=http://www.bluewin.ch/index_f.html

O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} (InstallerObj Class) - http://www.1-click.com/common/files/instal...hidden-test.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.zebulon.fr/outils/antivirus/kav...can_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

 

Grand MERCI

 

De plus ..je dois m'absenter des maintenant...

je regarderai demain....bonne soirée au membre du Zéb

Modifié le 11 novembre 2007 par kini1

[wong]

Bonsoir kini1,

 

Etude du rapport en cours.

 

Cordialement.

[wong]

Bonjour kini,

 

Questions :

 

1°) Est ce que tu as fait une désinfection de ton PC, car je vois sur le 1er rapport Antivir : ComboFix - FixWareout - SmitFraudFix.

 

2°) Je ne vois pas de Pare-feu d'installé, utilises-tu celui de XP ? Il faudra en mettre un vrai ( qui filtre les entrées et les sorties ).

 

 

Ton HijackThis :

 

1°) Connais-tu ces adresses ? :

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netplus.ch/

O14 - IERESET.INF: START_PAGE_URL=http://www.bluewin.ch/index_f.html

O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} (InstallerObj Class) - http://www.1-click.com/common/files/instal...hidden-test.cab

 

2°) Il y a aussi des lignes inutiles ( mais non infectieuses ).

 

 

Cordialement.

[kini1]

Bonjour kini,

 

Questions :

 

1°) Est ce que tu as fait une désinfection de ton PC, car je vois sur le 1er rapport Antivir : ComboFix - FixWareout - SmitFraudFix.

 

2°) Je ne vois pas de Pare-feu d'installé, utilises-tu celui de XP ? Il faudra en mettre un vrai ( qui filtre les entrées et les sorties ).

Ton HijackThis :

 

1°) Connais-tu ces adresses ? :

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netplus.ch/

O14 - IERESET.INF: START_PAGE_URL=http://www.bluewin.ch/index_f.html

O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} (InstallerObj Class) - http://www.1-click.com/common/files/instal...hidden-test.cab

 

2°) Il y a aussi des lignes inutiles ( mais non infectieuses ).

Cordialement.

 

Bonjour Wong...

 

En fait c'est l'ordi d'un copain

alors je ne connais rien des adresses R0 014 016......et de ces lignes inutiles

 

Pour la desinfection je n'ai pas vraiment compris ...car j'ai lancer un scan

en mode sans echec et quand il m'a trouver tout ces virus je les ai mis en quarantaine...

 

et quand c'etait fini... je me suis dit qu'il valai mieux les eliminer alors j'ai relancer

un scan et j'ai mis eliminer au lieu de quarantaine

 

je lui avait deja enlever quelques virus il y à je pense 7/8 mois en arriere avec l'aide

de Zeb

 

Il m'avait appeler cette semaine pour me dire qu'il avait un probleme

quand je suis arriver chez lui j'ai vu son antivirus Bit Defender etait perimer

alors je lui est installer Antivir

 

de la j'ai lancer un scan et il m'avait trouver 2 virus

alors j'ai pris le pc chez moi pour avoir plus de temps...

 

Alors dit moi ce qu'il faut faire pour enlever ces virus et rendre un peu mieux

son ordi???

 

je dois à nouveau m'absenter je serai la en fin de journée......

 

deja un grand merci

Modifié le 10 novembre 2007 par kini1

[wong]

Bonjour kini,

 

On va supprimer les utilitaires présents sur le PC, car ceux-ci sont mis à jour régulièrement.

 

Ferme toutes les applications en cours

 

Télécharge ToolsCleaner2 sur ton Bureau.

• Double clique sur ToolsCleaner2.exe > clique sur Extract sans changer la destination initiale.
  
• Ouvre le Poste de Travail > ouvre le Lecteur C:\
  
• Ouvre le dossier ToolsCleaner.
  
• Double clique sur ToolsCleaner2.bat et suis les directives.
  
• Fais un copier/coller du rapport qui se trouve dans C:\TCleaner.txt
  

Note : ton bureau va disparaître, c'est normal. S'il n'apparait pas à la fin du scan, fais la manip suivante :

CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.

Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau.

 

Cet utilitaire se désinstalle tout seul. Il va normalement supprimer HijackThis, mais comme tu n'as pas la dernière version, on va la télécharger ensuite.

 

J'attends le rapport.

 

@ +

[kini1]

Bonjour kini,

 

On va supprimer les utilitaires présents sur le PC, car ceux-ci sont mis à jour régulièrement.

 

Ferme toutes les applications en cours

 

Télécharge ToolsCleaner2 sur ton Bureau.

• Double clique sur ToolsCleaner2.exe > clique sur Extract sans changer la destination initiale.
  
• Ouvre le Poste de Travail > ouvre le Lecteur C:\
  
• Ouvre le dossier ToolsCleaner.
  
• Double clique sur ToolsCleaner2.bat et suis les directives.
  
• Fais un copier/coller du rapport qui se trouve dans C:\TCleaner.txt
  

Note : ton bureau va disparaître, c'est normal. S'il n'apparait pas à la fin du scan, fais la manip suivante :

CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.

Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau.

 

Cet utilitaire se désinstalle tout seul. Il va normalement supprimer HijackThis, mais comme tu n'as pas la dernière version, on va la télécharger ensuite.

 

J'attends le rapport.

 

@ +

 

 

Hello salut!!

 

Quand j'ouvre ce tools cleaner j'ai ceci

 

[[/url][/img]

 

apres je fait recherche....

 

j'ouvre le poste travail puis C/

 

et y a pas de dossier Tools cleaner y a seulement tolls.txt???

 

alors je suis un peu perdu

[wong]

Bonjour kini,

 

Il arrive que les liens des utilitaires changent ou ne fonctionnent plus.

 

Je cherche le nouveau lien et je reviens.

 

Pour l'instant supprime l'utilitaire de ton PC.

 

@ +

[kini1]

Bonjour kini,

 

Il arrive que les liens des utilitaires changent ou ne fonctionnent plus.

 

Je cherche le nouveau lien et je reviens.

 

Pour l'instant supprime l'utilitaire de ton PC.

 

@ +

 

ok........

[wong]

Bonjour kini,

 

Après avoir supprimé ce que tu as téléchargé, essaye avec ce lien. Assure-toi que tu n'as pas un résident qui empèche l'utuilitaire de s'installer.

 

Télécharge ToolsCleaner2 sur ton Bureau : http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

 

Si ça marche, Copie/Colle le rapport dans ta prochaine réponse.

 

@ +

[kini1]

Bonjour kini,

 

Après avoir supprimé ce que tu as téléchargé, essaye avec ce lien. Assure-toi que tu n'as pas un résident qui empèche l'utuilitaire de s'installer.

 

Télécharge ToolsCleaner2 sur ton Bureau : http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

 

Si ça marche, Copie/Colle le rapport dans ta prochaine réponse.

 

@ +

 

Hello....meme chose que precedement

 

pour le resident je sais pas comment on fait...

Modifié le 10 novembre 2007 par kini1