Vundo

Appliquer exactement les procédures indiquées.
Rester devant la machine en rafraichissant souvent le forum pour voir les nouvelles réponses.
Répondre sans attendre à toutes les questions posées
Ne pas quitter tant qu'il n'est pas dit explicitement que le problème est résolu ou qu'il
dépasse les compétences de celui ou ceux qui vous aident.


Nettoyage avec CCleaner
On va commencer par faire un peu le ménage

• Télécharger CCLeaner et l'installer sur le bureau en refusant l'installation de la barre Yahoo.
http://download.piriform.com/ccsetup205.exe
• Fermer toutes les applications
• Lancer CCLeaner
S'il n'est pas en Français cliquer sur Options, Setting, Language
et sélectionner Français
• cocher dans le menu Nettoyeur - onglet Windows :
Internet Explorer: Fichiers Internet Temporaires, Cookies
• Système: Vider la Poubelle, Fichiers Temporaires, Presse-papiers
• Avancé: Vieilles données du Prefetch
• Décocher dans le menu Options - sous-menu Avancé :
Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures
• Cocher dans le menu Nettoyeur - onglet Applications : Internet: Sun Java
• Cocher , si cela est possible, dans le menu Nettoyeur - onglet Applications :
Firefox/Mozilla: Cache Internet, Cookies
• Click sur Analyse
• Click sur le bouton Lancer le nettoyage dans le menu Nettoyeur.
• Click sur Registre
• Sélectionner tout
• Click sur Chercher des erreurs (En bas)

Une fois le scan terminé sélectionner tout
• Click sur Réparer les erreurs sélectionnées

Annoncer ici la fin de l'opération. Ce n'est pas la fin de la procédure.

CCleaner ne suffit pas. C'est un préalable pour démarrer sur une base à peu près propre.

On continue?

Sayai g fait ske tu ma dit booddha ensuite je fait koi????

J'ai fait un rapport avec antivir et voici se qui me donne:
(je ne suis pas très bon en anglais) donc si vous pouviez me dire ce que je doit faire après sa serai gentille merciii???

AntiVir PersonalEdition Classic
Report file date: jeudi 28 février 2008 12:42

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: MAISON-37FB0D88

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 14:27:04
ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 14:27:13
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 17:43:56
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 28 février 2008 12:42

The scan of running processes will be started
Scan process 'NoDNS.exe' - '1' Module(s) have been scanned
Scan process 'JavaCore.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'dumprep.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'Monitor.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
32 processes with 32 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
C:\Documents and Settings\maison\Local Settings\Temp\winlogon.exe
[WARNING] The file could not be opened!
The registry was scanned ( '27' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\maison\Local Settings\Temp\winlogon.exe
[WARNING] The file could not be opened!


End of the scan: jeudi 28 février 2008 13:32
Used time: 52:13 min

The scan has been done completely.

1764 Scanning directories
76386 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
76386 Files not concerned
553 Archives were scanned
4 Warnings
0 Notes

Salut,

J'aimerais que tu fasses ce qui est là : http://www.commentcamarche.net/forum/affich 5219925 cheval de troie sur mon pc#1

FillPCA Pas de demande d'aide par mp SVP.

Bonjour, voilà ce soir mon antivirus Avast m'a affiché une petite fenêtre grise qui me dit que j'ai un "cheval de troie" dans mon pc. Il me laisse le choix de le supprimer, renommer etc ...... J'ai alors cliké sur "supprimer", je voulais savoir si ça suffisait pour éliminer totalement ce cheval de mon pc ?????? merci dme répondre

Telecharge trojan remover et fait un scan quand il trouvera le virus tu le supprime (c'est en anglais dsl)

Trojan remover 6.6.5 cé bon?

Ouii c bon

Bon ca march pa, gé téléchargé MSNFix.zip et qd jsui les instruction ça march pa nonplu :-(

Bon voilà, donc j'ai tout fait !!
Finished s'est affiché, et je colle donc ici, comme demandé, le report du dossier SDFix, que faire ensuite????? car s'est marqué "avec un nouveau log Hijackthis" mais je comprend pas ce que ça veut dire ?? !! ...... merci !



[b]SDFix: Version 1.154 /b

Run by MICHAEL on 09/03/2008 at 00:35

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files /b:

Trojan Files Found:

C:\WINDOWS\mrofinu1423.exe - Deleted
C:\WINDOWS\mrofinu1423.exe.tmp - Deleted
C:\DOCUME~1\MICHAEL\LOCALS~1\Temp\services.exe - Deleted





Removing Temp Files

[b]ADS Check /b:



[b]Final Check /b:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-09 00:45:19
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\System32\\P2P Networking\\P2P Networking.exe"="C:\\WINDOWS\\System32\\P2P Networking\\P2P Networking.exe:*:Disabled:P2P Networking"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Disabled:Explorateur Windows"
"D:\\_nti40\\bin\\search.exe"="D:\\_nti40\\bin\\search.exe:*:Disabled:Verity Publisher"
"C:\\Program Files\\Wanadoo Messager\\Wanadoo Messager.exe"="C:\\Program Files\\Wanadoo Messager\\Wanadoo Messager.exe:*:Enabled:Application Messager"
"C:\\WINDOWS\\System32\\dpvsetup.exe"="C:\\WINDOWS\\System32\\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\System32\\lexpps.exe"="C:\\WINDOWS\\System32\\lexpps.exe:*:Enabled:LEXPPS.EXE"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Documents and Settings\\MICHAEL\\Bureau\\eMule\\emule.exe"="C:\\Documents and Settings\\MICHAEL\\Bureau\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Warez P2P Client\\warez.exe"="C:\\Program Files\\Warez P2P Client\\warez.exe:*:Disabled:Warez p2p client"
"C:\\Documents and Settings\\SEBASTIEN\\Bureau\\mes document\\X-Chat 2\\xchat.exe"="C:\\Documents and Settings\\SEBASTIEN\\Bureau\\mes document\\X-Chat 2\\xchat.exe:*:Disabled:X-Chat IRC Client"
@=""
"C:\\DOCUME~1\\MICHAEL\\LOCALS~1\\Temp\\services.exe"="C:\\DOCUME~1\\MICHAEL\\LOCALS~1\\Temp\\services.exe:*:Enabled:Flash Media"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files /b:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes /b:

Fri 29 Oct 2004 48 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Fri 29 Oct 2004 400 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Sun 9 Nov 2003 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv13.bak"
Wed 9 Jul 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 22 Oct 2004 22,528 ...H. --- "C:\Documents and Settings\RICHARD JL\Local Settings\Temp\~WRL0004.tmp"
Thu 8 Nov 2007 22,016 ...H. --- "C:\Documents and Settings\MICHAEL\Bureau\IUFM 2007 2008\~WRL1098.tmp"
Thu 8 Nov 2007 31,232 ...H. --- "C:\Documents and Settings\MICHAEL\Bureau\IUFM 2007 2008\~WRL1453.tmp"
Mon 19 Apr 2004 19,968 ...H. --- "C:\Documents and Settings\MARTINE\Local Settings\Temp\~WRL0004.tmp"
Mon 19 Apr 2004 20,480 ...H. --- "C:\Documents and Settings\MARTINE\Local Settings\Temp\~WRL3993.tmp"
Mon 19 Apr 2004 21,504 ...H. --- "C:\Documents and Settings\MARTINE\Local Settings\Temp\~WRL3187.tmp"
Sat 20 Oct 2007 401 A..H. --- "C:\Program Files\Wanadoo\richard.jeanluc\Ma Musique\Sauvegarde de la licence\drmv1lic.bak"
Wed 9 Jul 2003 4,348 ...H. --- "C:\Program Files\Wanadoo\richard.jeanluc\Ma Musique\Sauvegarde de la licence\drmv1key.bak"
Sat 20 Oct 2007 9,855 A.SH. --- "C:\Program Files\Wanadoo\richard.jeanluc\Ma Musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished!/b