PC infecté

[bmimikry]

désolée pour le malentendu, pour avast je voulais dire:

je l'ai désinstallé après avoir fait le hijack log plus haut. C'est pour ça qu'avast est toujours listé.

 

En fait microsoft office n'a plus de dossiers dans program files. Voilà ce qu'il arrive si je clic sur word (par exe) dans démarrer

 

http://www.hiboox.fr/go/images/informatiqu...31635a.jpg.html

 

et dans Roxio, je n'ai pas de ".exe" je ne sais donc pas sur quoi il faut cliquer. (pareil pour diskeeper, même si j'en ai plus besoin)

[Falkra]

Bizarre, mais pas forcément infectieux.

 

Il faudra réinstaller tout ça, de toute façon.

 

Je te recommande un scan complet avec Antivir. Mets-le à jour d'abord (clic droit, start update sur l'icône près de l'horloge).

Une fois à jour, double-clique sur son icône près de l'horloge, cela ouvre l'interface principale, puis clique sur "Scan system now" à droite de "Last complete system scan".

 

/!\ Cela peut être long.

Tu peux sauvegarder le rapport en fin de parcours (bouton "Report").

 

Si Antivir détecte des fichiers infectés, mets en quarantaine (choisis "Move to quarantine" dans la liste des actions. Tu peux automatiser ce type d'action en cochant une case), comme ci dessous :

 

Cela permet de ne pas rester à la surveiller.

[bmimikry]

et pour Internet Explorer, il a l'icone dans le dossier de program files, je clic dessus mais il ne s'ouvre pas.

[bmimikry]

d'accord, mais s'il faut tout réinstaller, comment je fais pour supprimer roxio et msoffice?

Juste avec ajout/supression de programmes? Faudrait pas qu'il y ait un problème lors de la réinstallation...

 

Merci en tout cas pour ton aide

[Falkra]

Tu peux essayer windows installer cleanup :

http://www.libellules.ch/dotclear/index.ph...taller-clean-up

 

Ou réinstaller par dessus, depuis le mode sans échec.

 

Il faut d'abord vérifier côté bestioles, le scan antivir serait à faire avant.

[bmimikry]

le antivir scan a eu 2 files qu'il ne pouvait pas ouvrir. est-ce que c'est normal?

 

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\hiberfil.sys

[WARNING] The file could not be opened!

[Falkra]

Ca oui, ce sont des fichiers verrouillés de windows. C'est tout ce qu'il a mentionné ? Le scan est déjà fini ?

[bmimikry]

oui, il est fini, par contre je n'ai pas enregistré le rapport. Tu en as besoin?

[Falkra]

J'aimerais le lire s'il y a plus d'infos. Tu peux lire tous les anciens rapports sans refaire un scan : ouvre Antivir (double-clique sur son icône près de l'horloge), clique sur "Overview" dans la colonne de gauche, puis sur "Reports" et trouve la ligne qui correspond à ton rapport elle doit s'appeler Scan, puis double clique dessus : là tu auras un bouton "Report file" pour lire et/ou poster le rapport.

[bmimikry]

En fait, je ne l'avais pas encore fermé. Le voilà:

 

Avira AntiVir Personal

Report file date: mardi 28 octobre 2008 15:54

 

Scanning for 996189 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: MITRA

 

Version information:

BUILD.DAT : 8.2.0.334 16933 Bytes 16/10/2008 14:55:00

AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 09:57:54

AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:42

LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:20

LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:54

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 13:34:26

ANTIVIR1.VDF : 7.1.0.1 2048 Bytes 27/10/2008 13:34:28

ANTIVIR2.VDF : 7.1.0.2 2048 Bytes 27/10/2008 13:34:28

ANTIVIR3.VDF : 7.1.0.7 56832 Bytes 28/10/2008 13:34:30

Engineversion : 8.2.0.9

AEVDF.DLL : 8.1.0.6 102772 Bytes 28/10/2008 13:35:22

AESCRIPT.DLL : 8.1.1.9 319867 Bytes 28/10/2008 13:35:20

AESCN.DLL : 8.1.1.3 123252 Bytes 28/10/2008 13:35:16

AERDL.DLL : 8.1.1.2 438644 Bytes 28/10/2008 13:35:14

AEPACK.DLL : 8.1.2.4 369014 Bytes 28/10/2008 13:35:06

AEOFFICE.DLL : 8.1.0.29 196988 Bytes 28/10/2008 13:35:00

AEHEUR.DLL : 8.1.0.63 1479032 Bytes 28/10/2008 13:34:58

AEHELP.DLL : 8.1.1.2 115062 Bytes 28/10/2008 13:34:44

AEGEN.DLL : 8.1.0.42 319861 Bytes 28/10/2008 13:34:42

AEEMU.DLL : 8.1.0.9 393588 Bytes 28/10/2008 13:34:38

AECORE.DLL : 8.1.2.8 172406 Bytes 28/10/2008 13:34:34

AEBB.DLL : 8.1.0.3 53618 Bytes 28/10/2008 13:34:32

AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:06

AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:02

AVREP.DLL : 8.0.0.2 98344 Bytes 28/10/2008 13:34:32

AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:42

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:24

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:50

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:04

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:42

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:12

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:08

RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:38

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:, F:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: mardi 28 octobre 2008 15:54

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'msiexec.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'CCleaner.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'soffice.bin' - '1' Module(s) have been scanned

Scan process 'soffice.exe' - '1' Module(s) have been scanned

Scan process 'WG111v3.exe' - '1' Module(s) have been scanned

Scan process 'sistray.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned

Scan process 'E_FATIBEE.EXE' - '1' Module(s) have been scanned

Scan process 'qttask.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'Monitor.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wanmpsvc.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'Explorer.EXE' - '1' Module(s) have been scanned

Scan process 'MDM.EXE' - '1' Module(s) have been scanned

Scan process 'SyncServices.exe' - '1' Module(s) have been scanned

Scan process 'DKService.exe' - '1' Module(s) have been scanned

Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

38 processes with 38 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD5

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Boot sector 'F:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '60' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <ACER>

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\mitra\Local Settings\Temp\wrdwn11

[0] Archive type: CAB (Microsoft)

--> wscui.cpl

[DETECTION] Is the TR/FakeAV.bak.2 Trojan

[NOTE] The file was moved to '496b2ad2.qua'!

C:\Documents and Settings\mitra\Local Settings\Temp\wrdwn14

[0] Archive type: CAB (Microsoft)

--> AVEngn.dll

[DETECTION] Is the TR/Fakealert.QF Trojan

[NOTE] The file was moved to '496b2ad3.qua'!

C:\Documents and Settings\mitra\Local Settings\Temp\wrdwn17

[0] Archive type: CAB (Microsoft)

--> wscui.cpl

[DETECTION] Is the TR/FakeAV.bak.2 Trojan

[NOTE] The file was moved to '48c81a64.qua'!

Begin scan in 'D:\' <ACERDATA>

D:\BSINSTALLDE.exe

[DETECTION] Contains recognition pattern of the DR/180Solutions.AO.16 dropper

[NOTE] The file was moved to '49502be3.qua'!

Begin scan in 'F:\' <OneTouch4>

F:\mp3 Mitra\Nouveau dossier\alanis morissette underneath.mp3

[DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit

[NOTE] The file was moved to '49682e79.qua'!

 

 

End of the scan: mardi 28 octobre 2008 16:25

Used time: 30:37 Minute(s)

 

The scan has been done completely.

 

5178 Scanning directories

366776 Files were scanned

5 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

5 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

366769 Files not concerned

7889 Archives were scanned

6 Warnings

5 Notes