AntiSpywareExpert, un cauchemar [résolu]

[Falkra]

Si "il" c'est antivir, mets en quarantaine ce qu'il trouve (on peut automatiser ça en cochant une case).

Poste le rapport (bouton "report") une fois terminé.

[laurier]

sinon, plus de traces de pop-up et tout semble avoir disparu.

C'est bon, tu crois ?

[Falkra]

Finis ton scan et poste le rapport (on a posté en même temps nos réponses).

[laurier]

Si "il" c'est antivir, mets en quarantaine ce qu'il trouve (on peut automatiser ça en cochant une case).

Poste le rapport (bouton "report") une fois terminé.

 

C'est bien antivir, oui

 

je mets en quarantaine, ça roule.

[laurier]

Et le rapport :

 

 

 

Avira AntiVir Personal

Report file date: vendredi 8 août 2008 21:38

 

Scanning for 1542139 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows Vista

Windows version: (Service Pack 1) [6.0.6001]

Boot mode: Normally booted

Username: SYSTEM

Computer name: PC-DE-CYRILLE

 

Version information:

BUILD.DAT : 8.1.0.326 16933 Bytes 11/07/2008 12:57:00

AVSCAN.EXE : 8.1.4.7 315649 Bytes 17/07/2008 17:50:59

AVSCAN.DLL : 8.1.4.0 40705 Bytes 17/07/2008 17:50:59

LUKE.DLL : 8.1.4.5 164097 Bytes 17/07/2008 17:50:59

LUKERES.DLL : 8.1.4.0 12033 Bytes 17/07/2008 17:50:59

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15

ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 17:35:06

ANTIVIR2.VDF : 7.0.5.207 2316800 Bytes 04/08/2008 17:43:44

ANTIVIR3.VDF : 7.0.5.234 160256 Bytes 08/08/2008 17:42:49

Engineversion : 8.1.1.19

AEVDF.DLL : 8.1.0.5 102772 Bytes 17/04/2008 07:34:30

AESCRIPT.DLL : 8.1.0.63 311673 Bytes 06/08/2008 17:42:50

AESCN.DLL : 8.1.0.23 119156 Bytes 15/07/2008 17:45:59

AERDL.DLL : 8.1.0.20 418165 Bytes 25/04/2008 19:13:39

AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 17:45:58

AEOFFICE.DLL : 8.1.0.21 192891 Bytes 18/07/2008 17:45:25

AEHEUR.DLL : 8.1.0.47 1368437 Bytes 06/08/2008 17:42:49

AEHELP.DLL : 8.1.0.15 115063 Bytes 29/05/2008 17:22:15

AEGEN.DLL : 8.1.0.35 315764 Bytes 06/08/2008 17:42:47

AEEMU.DLL : 8.1.0.7 430452 Bytes 01/08/2008 17:42:32

AECORE.DLL : 8.1.1.8 172406 Bytes 01/08/2008 17:42:31

AEBB.DLL : 8.1.0.1 53617 Bytes 17/07/2008 08:17:43

AVWINLL.DLL : 1.0.0.12 15105 Bytes 17/07/2008 17:50:59

AVPREF.DLL : 8.0.2.0 38657 Bytes 17/07/2008 17:50:59

AVREP.DLL : 8.0.0.2 98344 Bytes 01/08/2008 17:42:30

AVREG.DLL : 8.0.0.1 33537 Bytes 17/07/2008 17:50:59

AVARKT.DLL : 1.0.0.23 307457 Bytes 17/04/2008 07:34:28

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 17/07/2008 17:50:59

SQLITE3.DLL : 3.3.17.1 339968 Bytes 17/04/2008 07:34:29

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 17/07/2008 17:50:59

NETNT.DLL : 8.0.0.1 7937 Bytes 17/04/2008 07:34:29

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 17/07/2008 17:50:56

RCTEXT.DLL : 8.0.52.0 86273 Bytes 17/07/2008 17:50:56

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: C:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: vendredi 8 août 2008 21:38

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned

Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned

Scan process 'iexplore.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'taskeng.exe' - '1' Module(s) have been scanned

Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned

Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned

Scan process 'CoreCom.exe' - '1' Module(s) have been scanned

Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned

Scan process 'Deskboard.exe' - '1' Module(s) have been scanned

Scan process 'taskeng.exe' - '1' Module(s) have been scanned

Scan process 'unsecapp.exe' - '1' Module(s) have been scanned

Scan process 'Launcher.exe' - '1' Module(s) have been scanned

Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned

Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned

Scan process 'AlertModule.exe' - '1' Module(s) have been scanned

Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'daemon.exe' - '1' Module(s) have been scanned

Scan process 'vVX1000.exe' - '1' Module(s) have been scanned

Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned

Scan process 'WUDFHost.exe' - '1' Module(s) have been scanned

Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'MSCamS32.exe' - '1' Module(s) have been scanned

Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned

Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'dwm.exe' - '1' Module(s) have been scanned

Scan process 'brss01a.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'taskeng.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'SLsvc.exe' - '1' Module(s) have been scanned

Scan process 'audiodg.exe' - '0' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'lsm.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'wininit.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

59 processes with 59 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '42' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <HDD>

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\0.exe.vir

[DETECTION] Contains recognition pattern of the PHISH/FraudTool.WinAntiVirus.AT phishing file/email

[NOTE] The file was moved to '4901a930.qua'!

C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\3.exe.vir

[DETECTION] Contains recognition pattern of the PHISH/FraudTool.WinAntiVirus.AU phishing file/email

[NOTE] The file was moved to '4901a9ce.qua'!

C:\QooBox\Quarantine\C\Windows\System32\tdssmain.dll.vir

[DETECTION] Is the TR/Agent.AJLX Trojan

[NOTE] The file was moved to '490faa0a.qua'!

C:\Windows\System32\drivers\sptd.sys

[WARNING] The file could not be opened!

 

 

End of the scan: vendredi 8 août 2008 22:53

Used time: 1:15:44 Hour(s)

 

The scan has been done completely.

 

16391 Scanning directories

303075 Files were scanned

3 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

3 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

303070 Files not concerned

2112 Archives were scanned

2 Warnings

3 Notes

[Falkra]

Ok, bah c'est normal alors, il avait trouvé la quarantaine de ComboFix, c'est pour ça qu'on ne le fait pas tout de suite en général.

 

Tu peux désinstaller combofix : entre combofix /u dans la boite exécuter du menu démarrer.

Après cela, efface ce dossier s'il existe encore.

C:\QooBox

[laurier]

Désolé, c'est quoi la boîte exécuter dans le menu démarrer ?

[laurier]

J'ai z'été chercher et j'ai trouvé comment faire apparaitre exécuter, je poursuis...

[Falkra]

Dans le menu démarrer, il y a une option exécuter, sinon essaie les touches Win+R pour l'ouvrir.

[laurier]

pas sur vista, mais j'ai trouvé.

 

Combofix n'est plus. Je fais quoi maintenant ?