Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

POUVEZ VOUS ME DIRE SI CA CLOCHE

Cendrillon

Par Cendrillon
dans Analyses et éradication malwares

 Partager

Messages recommandés

Cendrillon Power Member

Cendrillon

Posté(e)
  • Auteur
Posté(e)

bonjour, voici le résultat.

 

j'ai remis advast comme antivirus, car avec avira antivir, j'étaits sans arrêt bloquer par des messages d'intrustion ...

 

je te tiens au courant si je constate un peu plus de rapidité

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:26:54, on 27/01/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\Magentic\bin\MgApp.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wuauclt.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1111332160843

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} (NetCamPlayerWeb11gv2 Control) - http://campasteur.homedns.org/NetCamPlayerWeb11gv2.cab

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

 

--

End of file - 8189 bytes

 

bys

oGu Godlike Member

oGu

Posté(e)
Posté(e)
bonjour, voici le résultat.

 

j'ai remis advast comme antivirus, car avec avira antivir, j'étaits sans arrêt bloquer par des messages d'intrustion ...

 

Yo!

 

Drôle de conception de la sécurité informatique que de se passer d'un antivirus performant faisant son boulot en signalant les intrusions (Antivir), au profit d'un autre AV moins performant (et qui, en toute logique, ne prévient pas lors d'intrusions car il en est INCAPABLE!) comme Avast!...Certes, tu seras "tranquille " car tu n'auras pas d'alertes, mais à la place tu auras des infections...La belle affaire!

 

Si Antivir te prévient, c'est peut-être qu'il y a des raisons non???

 

Réinstalle-le et lance un scan en suivant ce tuto:

 

http://www.malekal.com/tutorial_antivir.php

 

Puis poste ici le rapport voir quelles sont les alertes.

Cendrillon Power Member

Cendrillon

Posté(e)
  • Auteur
Posté(e)
Yo!

 

Drôle de conception de la sécurité informatique que de se passer d'un antivirus performant faisant son boulot en signalant les intrusions (Antivir), au profit d'un autre AV moins performant (et qui, en toute logique, ne prévient pas lors d'intrusions car il en est INCAPABLE!) comme Avast!...Certes, tu seras "tranquille " car tu n'auras pas d'alertes, mais à la place tu auras des infections...La belle affaire!

 

Si Antivir te prévient, c'est peut-être qu'il y a des raisons non???

 

Réinstalle-le et lance un scan en suivant ce tuto:

 

http://www.malekal.com/tutorial_antivir.php

 

Puis poste ici le rapport voir quelles sont les alertes.

 

 

avast m'a pourtant été conseillé par des membres "qualifiés" de Zebulon ...

as tu détecté des intrusions dans les logs postés précédemment ? cela fait plusieurs mois que je l'ai installé, et n'ai jamais eu de problème visible :P

oGu Godlike Member

oGu

Posté(e)
Posté(e) (modifié)

Salut.

 

avast m'a pourtant été conseillé par des membres "qualifiés" de Zebulon ...

 

Cela m'étonnerait fort car cela fait des mois que nous expliquons à longueur de post que Avast! est dépassé.

 

Malekal, membre actif de l'Equipe Sécurité de Zeb' (et donc "qualifié" pour reprendre tes termes) en a fait un sujet éloquent et très détaillé techniquement :

 

http://forum.malekal.com/ftopic3528.php

 

 

as tu détecté des intrusions dans les logs postés précédemment ? cela fait plusieurs mois que je l'ai installé, et n'ai jamais eu de problème visible :P

 

Tu me dis qu'Antivir a émis des alertes: peux-tu s'il te plaît le réinstaller, scanner ta machine et poster le rapport??

Modifié par ogu
Cendrillon Power Member

Cendrillon

Posté(e)
  • Auteur
Posté(e)
Salut.

Cela m'étonnerait fort car cela fait des mois que nous expliquons à longueur de post que Avast! est dépassé.

 

Malekal, membre actif de l'Equipe Sécurité de Zeb' (et donc "qualifié" pour reprendre tes termes) en a fait un sujet éloquent et très détaillé techniquement :

 

http://forum.malekal.com/ftopic3528.php

 

 

Tu me dis qu'Antivir a émis des alertes: peux-tu s'il te plaît le réinstaller, scanner ta machine et poster le rapport??

 

 

j'essaierai ce soir.

ce qui me gêne avec antivir c'est qu'il est tout en anglais, et que je ne maitrise pas les termes techniques. de plus si les alertes me dérangent c'est qu'elles apparaissent les une après les autres, et donc je passe mon temps à fermer les blocs qui s'affichent (environ une vingtaine en moins d'une minute ...)

oGu Godlike Member

oGu

Posté(e)
Posté(e)
les alertes me dérangent c'est qu'elles apparaissent les une après les autres, et donc je passe mon temps à fermer les blocs qui s'affichent (environ une vingtaine en moins d'une minute ...)

 

Si tu as des alertes, c'est que tu es infectée, et qu'il faut réagir. Installer un mauvais antivirus qui laisse passer les infections ne peut pas être une solution!! Autrement, autant ne pas en installer, et là tu ne seras effectivement jamais inquiétée par quelque alerte que ce soit.

Cendrillon Power Member

Cendrillon

Posté(e)
  • Auteur
Posté(e)

le centre de sécurité windows me dit que ma version d'antivir est périmée et que mon pc n'est pas protégé !!!!! (antivir personal edition classic)

 

je suis en train de faire le scan

 

je le poste dès que c'est fini :P

oGu Godlike Member

oGu

Posté(e)
Posté(e)
le centre de sécurité windows me dit que ma version d'antivir est périmée et que mon pc n'est pas protégé !!!!! (antivir personal edition classic)

 

Le centre de sécurité se trompe, comme bien souvent!!

 

Il ne se rend tout simplement pas compte qu'Antivir est installé...Rien de grave, on y remédiera plus tard.

Cendrillon Power Member

Cendrillon

Posté(e)
  • Auteur
Posté(e)

voilà :

AntiVir PersonalEdition Classic

Report file date: mercredi 30 janvier 2008 18:41

 

Scanning for 1036370 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name: PC-BECERRIL

 

Version information:

BUILD.DAT : 269 15604 Bytes 10/09/2007 14:31:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20

ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 12:32:40

ANTIVIR1.VDF : 6.39.0.129 7251968 Bytes 10/07/2007 12:32:46

ANTIVIR2.VDF : 6.39.1.43 1542656 Bytes 25/08/2007 17:21:02

ANTIVIR3.VDF : 6.39.1.51 29696 Bytes 28/08/2007 07:22:36

AVEWIN32.DLL : 7.6.0.5 2789888 Bytes 29/08/2007 17:09:10

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: F:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: mercredi 30 janvier 2008 18:41

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'distnoted.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceHelper.exe' - '1' Module(s) have been scanned

Scan process 'iTunes.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wscntfy.exe' - '1' Module(s) have been scanned

Scan process 'iPodService.exe' - '1' Module(s) have been scanned

Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned

Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'incdsrv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'COCIManager.exe' - '1' Module(s) have been scanned

Scan process 'MgApp.exe' - '1' Module(s) have been scanned

Scan process 'EM_EXEC.EXE' - '1' Module(s) have been scanned

Scan process 'LVComSX.exe' - '1' Module(s) have been scanned

Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'realsched.exe' - '1' Module(s) have been scanned

Scan process 'reader_sl.exe' - '1' Module(s) have been scanned

Scan process 'InCD.exe' - '1' Module(s) have been scanned

Scan process 'QuickCam10.exe' - '1' Module(s) have been scanned

Scan process 'Communications_Helper.exe' - '1' Module(s) have been scanned

Scan process 'iTouch.exe' - '1' Module(s) have been scanned

Scan process 'opwareSE2.exe' - '1' Module(s) have been scanned

Scan process 'soundman.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

52 processes with 52 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[NOTE] No virus was found!

Master boot sector HD1

[NOTE] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'E:\'

[NOTE] No virus was found!

Boot sector 'F:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '26' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PWZZ2Q0D\upgrade[1].cab

[0] Archive type: CAB (Microsoft)

--> upgrade.exe

[DETECTION] Contains detection pattern of the dropper DR/OneStep.A.1

[iNFO] The file was moved to '4807b7fa.qua'!

C:\Documents and Settings\M.Becerril\bbadnh.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4801b7f2.qua'!

C:\Documents and Settings\M.Becerril\daaibi.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4801b7f4.qua'!

C:\Documents and Settings\M.Becerril\dkhhsg.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4808b804.qua'!

C:\Documents and Settings\M.Becerril\dvmatp.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '480db810.qua'!

C:\Documents and Settings\M.Becerril\fdvddz.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4816b7fe.qua'!

C:\Documents and Settings\M.Becerril\ftykxq.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4819b80e.qua'!

C:\Documents and Settings\M.Becerril\gicxxm.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4803b803.qua'!

C:\Documents and Settings\M.Becerril\gqckin.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4803b80c.qua'!

C:\Documents and Settings\M.Becerril\hhcifs.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '48fd8f84.qua'!

C:\Documents and Settings\M.Becerril\jmlqwd.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '480cb808.qua'!

C:\Documents and Settings\M.Becerril\klygpp.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4819b807.qua'!

C:\Documents and Settings\M.Becerril\kxqymv.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4811b814.qua'!

C:\Documents and Settings\M.Becerril\lftpfx.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4814b802.qua'!

C:\Documents and Settings\M.Becerril\ljqmgs.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4811b806.qua'!

C:\Documents and Settings\M.Becerril\ltlwmd.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '480cb810.qua'!

C:\Documents and Settings\M.Becerril\mkjani.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '480ab808.qua'!

C:\Documents and Settings\M.Becerril\obajej.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4801b7ff.qua'!

C:\Documents and Settings\M.Becerril\pizwzm.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '481ab806.qua'!

C:\Documents and Settings\M.Becerril\qfievd.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4809b803.qua'!

C:\Documents and Settings\M.Becerril\qtumdw.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4815b812.qua'!

C:\Documents and Settings\M.Becerril\rlqesr.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4811b80a.qua'!

C:\Documents and Settings\M.Becerril\rzovrj.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '480fb818.qua'!

C:\Documents and Settings\M.Becerril\smvsqh.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4816b80c.qua'!

C:\Documents and Settings\M.Becerril\tsphgh.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4810b812.qua'!

C:\Documents and Settings\M.Becerril\tvgmyz.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4807b815.qua'!

C:\Documents and Settings\M.Becerril\uhuyzi.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4815b808.qua'!

C:\Documents and Settings\M.Becerril\uuosnd.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '480fb815.qua'!

C:\Documents and Settings\M.Becerril\uwapvk.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4801b817.qua'!

C:\Documents and Settings\M.Becerril\vcszyl.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4813b803.qua'!

C:\Documents and Settings\M.Becerril\wsweji.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4817b814.qua'!

C:\Documents and Settings\M.Becerril\xdpizx.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4810b805.qua'!

C:\Documents and Settings\M.Becerril\xsiurn.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4809b814.qua'!

C:\Documents and Settings\M.Becerril\yhbloh.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '4802b809.qua'!

C:\Documents and Settings\M.Becerril\yzzzql.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '481ab81c.qua'!

C:\Documents and Settings\M.Becerril\zlybzh.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '48e78f8f.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP256\A0106806.exe

[DETECTION] Is the Trojan horse TR/FakeAV.15.A

[iNFO] The file was moved to '47d1bcda.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137529.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdf9.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137530.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdfa.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137531.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e80f3.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137532.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdfb.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137533.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e80f4.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137534.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdfc.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137535.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdfd.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137536.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e80f6.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137537.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdfe.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137538.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e80f7.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137539.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdf0.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137540.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1bdff.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137541.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e8308.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137542.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be01.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137543.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be00.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137544.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e8309.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137545.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be02.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137546.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e830a.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137547.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be03.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137548.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e830c.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137549.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be05.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137550.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e830b.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137551.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be04.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137552.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e830d.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137553.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be06.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137554.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e830e.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137555.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be07.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137556.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e8300.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137557.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be09.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137558.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e830f.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137559.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be18.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137560.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e8311.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137561.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be1a.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137562.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '472e8302.qua'!

C:\System Volume Information\_restore{81CF3CBA-1C66-4906-ACA5-7E480E213B9A}\RP315\A0137563.exe

[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/Bankfraud

[iNFO] The file was moved to '47d1be0b.qua'!

C:\WINDOWS\album95.zip

[DETECTION] Contains detection pattern of the worm WORM/IRCBot.acu.1

[iNFO] The file was moved to '4802be44.qua'!

C:\WINDOWS\photos2007_82.zip

[DETECTION] Contains detection pattern of the worm WORM/IRCBot.acu.1

[iNFO] The file was moved to '480fbe42.qua'!

C:\WINDOWS\photo_album1.zip

[DETECTION] Contains detection pattern of the worm WORM/IRCBot.acu.1

[iNFO] The file was moved to '480fbe43.qua'!

C:\WINDOWS\photo_album49.zip

[DETECTION] Contains detection pattern of the worm WORM/IRCBot.acu.1

[iNFO] The file was moved to '48f28fbc.qua'!

Begin scan in 'E:\'

E:\Documents and Settings\Audrey\.limewire\.NetworkShare\LimeWireWinInstaller 1.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\.limewire\.NetworkShare\LimeWireWinInstaller.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Application Data\HbTools\v3.0\HbTools\static\1\country.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Application Data\HbTools\v3.0\HbTools\static\2\country.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Application Data\Mozilla\Firefox\Profiles\vo64ipsc.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Application Data\Mozilla\Firefox\Profiles\vo64ipsc.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Application Data\Mozilla\Firefox\Profiles\vo64ipsc.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\unins000.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Application Data\Mozilla\Firefox\Profiles\vo64ipsc.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\PNRComponent.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Bureau\pfs-setup.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Bureau\phedinst.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\AutoRun.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\AutoRunGUI.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\eauninstall.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\First15.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\IadHide5.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Install_Messenger.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\MFPL7014.DLL

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\mPlayer.cr.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\MsgPlusUninstall.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\quickcamfra.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ShopperReportsUpgrade.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\SIntf16.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\SIntf32.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\SIntfNT.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\sPDPatch.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\tweed.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\uninstall.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\VP6Install.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\VP6VFW.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\xpinstall.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\js3250.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\nspr4.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\plc4.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\plds4.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\xpcom_compat.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\xpcom_core.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\components\jar50.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ff_temp\xpcom.ns\bin\components\xpinstal.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\GGS104.tmp\setuphook.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\ins1.tmp\LDMClient.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\isp14.tmp\_Setup.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\mioreader\[starter]\mioreader251.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\SetupX.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\50comupd.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\instmsia.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\instmsiw.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\ShFolder.Exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\MS\System\asycfilt.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\MS\System\mfc42.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\MS\System\msvcirt.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\MS\System\msvcp60.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\MS\System\msvcrt.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\MS\System\oleaut32.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\Redist\MS\System\olepro32.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\setup\NeroDelTmp.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\Nero7.tmp\setup\nps.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nro.tmp\AdvrCntr2.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nro.tmp\ShellManager.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nro.tmp\ShellManager10E2D762.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nseE7.tmp\ExecCmd.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nseE7.tmp\InstallOptions.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nseE7.tmp\nsExec.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nseE7.tmp\System.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nseE7.tmp\Universal UXTheme Patcher v2.1.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nsg305.tmp\ExecCmd.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nsg305.tmp\InstallOptions.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nsg305.tmp\nsExec.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nsg305.tmp\System.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nsg305.tmp\Universal UXTheme Patcher v2.1.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nsm13AD.tmp\NSIS_Picasa.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\nso13B2.tmp\NSIS_Picasa.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\SLF2975.tmp\Maxx_GP_Telecharger{5727}.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\SLF51D1.tmp\LUXOR-_Amun_Rising_Telecharger{84760}.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\SLF5965.tmp\Singles_2_Telecharger(fr_557){37521}.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\SLF6DAD.tmp\Diner_Dash_Flo_on_the_Go_Telecharger{219112}.exe

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\~rnsetup\pncrt.dll

[WARNING] The file could not be opened!

E:\Documents and Settings\Audrey\Local Settings\Temp\~rnsetup\pnrs3260.dll

[WARNING] The file could not be opened!

Begin scan in 'F:\'

 

 

End of the scan: mercredi 30 janvier 2008 19:46

Used time: 1:05:17 min

 

The scan has been done completely.

 

13739 Scanning directories

418947 Files were scanned

76 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

76 files were moved to quarantine

0 files were renamed

81 Files cannot be scanned

418871 Files not concerned

5931 Archives were scanned

81 Warnings

0 Notes

 

alors résultat ?

 

:P

oGu Godlike Member

oGu

Posté(e)
Posté(e) (modifié)

Salut Audrey :P !

 

Antivir a fait du bon travail, on va le compléter.

 

Tu ne sembles pas infectée durement, l'antivirus a supprimé des dossiers malsains.

 

PREMIERE ETAPE

 

Supprimer les fichiers temporaires:

 

  • Installer le logiciel
  • Lancer le logiciel
  • Cliquer sur l'onglet "Nettoyeur"
  • Cliquer sur le bouton "Lancer le nettoyage"
     
     


    SECONDE ETAPE



     
    Contrôle d'un dossier
     
    Sais-tu ce qu'est ce dossier en couleur:
     
    C:\Documents and Settings\M.Becerril\
     
    ??
     
    Il contenait de nombreuses infections.


     
     
     

    TROISIEME ETAPE



     
    Désactiver puis réactiver la restauration système:
     


  • Aller dans le menu "Démarrer"
  • Cliquer droit sur l'icone "Poste de travail"
  • Dans l'onglet "Restauration du système", sélectionner "Désactiver la Restauration du système sur tous les lecteurs".
  • Cliquez sur "Appliquer."
  • Lorsque le message de confirmation apparaît, cliquer sur "Oui"

  • Cliquer enfin sur "OK".
  • Redémarrer
  • Puis:
  • Aller dans le menu "Démarrer"
  • Cliquer droit sur l'icone "Poste de travail"
  • Dans l'onglet "Restauration du système", décocher la case "Désactiver la Restauration du système sur tous les lecteurs".
  • Cliquez sur "Appliquer."
  • Lorsque le message de confirmation apparaît, cliquer sur "Oui"

  • Cliquer enfin sur "OK".
     
     
     
     

    QUATRIEME ETAPE



     
    Supprimer les logiciels de peer-to-peer
     
    Désinstalle LimeWire et tout autre logiciels de peer-to-peer, qui sont des nids à virus: lis cet article:
     
    -l'article sur les dangers des cracks:
     
    http://forum.zebulon.fr/index.php?showtopic=85544
     
    Va faire un tour sur le forum de désinfection, il y a autant d'infections dûes à MSN qu'au peer-to-peer: merci donc de désinstaller LimeWire sous peine de nouvelle infection !
     
     
    Une fois désinstallés ces logiciels:
     
     
    Supprimer un fichier

  • Supprime ce fichier:
    E:\Documents and Settings\Audrey\.limewire\.NetworkShare\LimeWireWinInstaller 1.exe

 

CINQUIEME ETAPE

  • Contrôle antispyware:

     
    Télécharger
ewido anti-spyware micro scanner sur ton bureau.
Double-cliquer sur le fichier ewido_micro.exe pour l'exécuter.
Le programme va demander dès son lancement un accès internet pour se mettre à jour: accepter.
Puis, un nouvel écran apparaît,s'assurer que toutes les cases soient cochées.
Cliquer sur Start Scan et laisse l'outil travailler.
Quand l'outil à fini, cliquer sur save report et sauvegarder le rapport sur le bureau.
Poster le rapport dans la prochaine réponse.

  • Nb, ne pas cliquer tout de suite sur Remove infections; nous devons nous assurer que toutes les détections sont infectieuses car certains utilitaires légitimes pourraient apparaître dans le rapport.

 

 

 

SIXIEME ETAPE

  • Contrôle antirootkit:
     

  • Télécharger BlackLight de F-Secure sur ton bureau:
     
    ftp://ftp.f-secure.com/f-prot/tools/fsbl.exe


  • Double-cliquer sur fsbl (il n'y a pas besoin d'installation), accepter la licence, puis cliquer sur "scan".

  • Poster le rapport ici même (il se trouvera sur le bureau)

 

 

 

SEPTIEME ETAPE

 

Scan Antivir:

 

Tu sais faire, relance-le et poste le rapport.

 

 

 

HUITIEME ETAPE

 

 

Scan HijackThis:

 

Tu sais faire, relance-le et poste le rapport.

 

 

 

 

 

Tu dois donc poster 4 rapports: Ewido, BlackLight, Antivir, HijackThis.

 

Ils permettront de s'assurer que tout va bien, ou d'isoler une éventuelle infection.

 

 

Prend le temps de faire tout ça, bon travail et bonne soirée !

Modifié par ogu

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...