Adware Win32:Adware-gen

bonjour,

tu as installé messenger plus avec le sponssor ?
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Bonjour, et merci de ta réponse !
Non, pas que je sache... Mais est-il possible que ça se soit installé lors d'une mise à jour de messenger?

bonjour,

je ne pensse pas, c´est a l´installation que ca se passe :

http://theroot.chez-alice.fr/imgs/tuto/msgplus.jpg
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Non, je ne pense pas avoir installé ça, je suis assez vigilante au respect de ma vie privée !

bon

quel fichier est detecté par avast?

car ton hijack this ne devoile pas d´infection visible


Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

En fait, il s'agit apparemment d'un fichier zip téléchargé, mais que je n'ai pas ouvert...
J'ai relancé le scan avast...

att rdpouces

regarde ceci :

Antivir vs Avast :

->http://forum.malekal.com/ftopic3528.php

desinstale avast et instale antivir a la place et scan avec lui

->http://www.malekal.com/tutorial_antivir.php

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner...

@+
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

J'ai réussi à le localoser dans la quarantaine et à priori, il a été supprimé par avast... J'attends la fin du scan pour confirmation !

tu as vu mon post 7?
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Oui, je suis en train d'effectuer un scan avec antivir, et il a déjà trouvé un cheval de troie non signalé par avast !!
Merci beaucoup pour tes conseils !

ok post le rapport a la fin du scan
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Voilà, c'est fini, et ça donne ça :




AntiVir PersonalEdition Classic
Report file date: vendredi 23 novembre 2007 16:56

Scanning for 941284 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: SCUB

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.0 1393152 Bytes 23/11/2007 15:47:34
ANTIVIR3.VDF : 7.0.1.4 11776 Bytes 23/11/2007 15:47:34
AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 23/11/2007 15:47:35
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: J:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 23 novembre 2007 16:56

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'thunderbird.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'uzqkst.exe' - '1' Module(s) have been scanned
Scan process 'FINDFAST.EXE' - '1' Module(s) have been scanned
Scan process 'OSA.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'wcescomm.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'MsgPlus.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'htpatch.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'I:\'
[NOTE] No virus was found!
Boot sector 'J:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '29' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\renaud\Bureau\EMULE\Peintres\1\Alessandro Botticelli\Augustin_Botticelli.jpg
[DETECTION] Is the Trojan horse TR/Spy.Banker.vk.1
[INFO] The file was moved to '47adf8e7.qua'!
C:\WINDOWS\system32\drivers\atapi.sys
[WARNING] The file could not be opened!
Begin scan in 'I:\'
Begin scan in 'J:\'


End of the scan: vendredi 23 novembre 2007 19:47
Used time: 2:51:15 min

The scan has been done completely.

11253 Scanning directories
618819 Files were scanned
1 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
1 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
618818 Files not concerned
11576 Archives were scanned
3 Warnings
1 Notes

re,

ahh botticelli y t´en fais voire de toute les couleures....

fais attention avec e-mule...

vide la quarantaine d´antivir

instale ce par feu :

kerio 4.2

http://www.pcentraide.com/index.php?showtopic=110

http://kerio.probb.fr/configurer-parametrer-sunbelt-personal­-firewall-kerio-f2/

on se tiens au courrant

je vais me coucher

bonne fin de soirée

@+
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Un grand merci pour le temps que t'y a passé ! Je te tiens au courant !

de rien rdpouces,
oui tiens moi au courrant de l´evolution de la situation
@+
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Bonjour g!rly !
Alors voilà, j'ai refait un scan avec antivir, pour être sûre, voilà le rapport :




AntiVir PersonalEdition Classic
Report file date: samedi 24 novembre 2007 09:14

Scanning for 941284 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: SCUB

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.0 1393152 Bytes 23/11/2007 15:47:34
ANTIVIR3.VDF : 7.0.1.4 11776 Bytes 23/11/2007 15:47:34
AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 23/11/2007 15:47:35
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: J:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: samedi 24 novembre 2007 09:14

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'thunderbird.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'uzqkst.exe' - '1' Module(s) have been scanned
Scan process 'FINDFAST.EXE' - '1' Module(s) have been scanned
Scan process 'OSA.EXE' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'wcescomm.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'MsgPlus.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'htpatch.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
49 processes with 49 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'I:\'
[NOTE] No virus was found!
Boot sector 'J:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '29' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\atapi.sys
[WARNING] The file could not be opened!
Begin scan in 'I:\'
Begin scan in 'J:\'


Voilà voilà ! Par contre, j'ai désinstallé le firewall, parce que j'arrivais plus à me connecter sur internet pour la plupart des sites...
J'ai essayé de faire des réglages, mais rien ne marchait... Je pense rester avec le Firewall de windows, qu'en penses-tu ?
Merci pour tout :)

salut Rdpouces,

le scan d´antivir est propre :-)

par contre le par feu de windows ne sert a rien, c´est comme si tu n´en avais pas, ca craind...

essaie d´installer zone alarm il est plus facil a configurer :

zone alarm :

http://www.kachouri.com/...

dis moi quoi

@+

Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Coucou !

C'est quoi les warnings dans le scan d'antivir, dois-je m'en inquiéter ?
En ce qui concerne Zone Alarm, impossible de l'installer... Je l'ai téléchargé, il l'a installé dans un dossier Zone Alarm, avec plein d'autres dossiers; mais chaque fois que je veux installer le programme, j'ai un message d'erreur, me demandant si je veux envoyer un rapport d'erreur, à 3 reprises. Je n'arrive pas plus à le désinstaller....
Bref, c'est pas terrib' !

salut rd pouces

pour les warning d´antivir c´est normal il t´avertie juste qu´il ´a pas pu scanner les fichiers

C:\hiberfil.sys
WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\atapi.sys
[WARNING] The file could not be opened

regarde ceci pour desinstaller zone alarm : la reponse de jean chretien

http://forum.telecharger.01net.com/...

c´est bizare quand meme

tu veux pas reessayer kerio :

par feu : kerio

Kerio (pare-feu) : reste gratuit après la période d'essai en français
----> http://telechargement.zebulon.fr/kerio.html

Regarde ce tutoriel si tu as besoin d'aide pour l'installation et la configuration de Kerio
--> http://kerio.probb.fr/...

Plus d'info :
->http://kerio.probb.fr/index.forum

@+
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil