[Résolu] cheval de troie et alertes spyware/windows security etc...
Forum Sécurité - Virus : [Résolu] cheval de troie et alertes spyware/windows security etc...
voilà c'est fait, voici les nouveaux rapports 
vundofix :
VundoFix V6.7.7
Checking Java version...
Sun Java not detected
Scan started at 19:56:44 26/01/2008
Listing files found while scanning....
C:\WINDOWS\system32\byxyxyx.dll
C:\WINDOWS\system32\khfffdd.dll
C:\WINDOWS\system32\qomnnmj.dll
C:\WINDOWS\system32\tuvwxuv.dll
C:\WINDOWS\system32\urqrpml.dll
C:\WINDOWS\system32\winjjq32.dll
C:\WINDOWS\system32\winjks32.dll
C:\WINDOWS\system32\winopn32.dll
Beginning removal...
Attempting to delete C:\WINDOWS\system32\byxyxyx.dll
C:\WINDOWS\system32\byxyxyx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\khfffdd.dll
C:\WINDOWS\system32\khfffdd.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\qomnnmj.dll
C:\WINDOWS\system32\qomnnmj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\tuvwxuv.dll
C:\WINDOWS\system32\tuvwxuv.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\urqrpml.dll
C:\WINDOWS\system32\urqrpml.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\winjjq32.dll
C:\WINDOWS\system32\winjjq32.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\winjks32.dll
C:\WINDOWS\system32\winjks32.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\winopn32.dll
C:\WINDOWS\system32\winopn32.dll Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\urqrpml.dll
C:\WINDOWS\system32\urqrpml.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
et Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:14:34, on 26/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\TEMP\win1DD.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6750EF42-09E0-4238-B283-20F4E1697A85} - C:\Program Files\Windows NT\hokenowC:\WINDOWS\system32\uwcee9\renamd83122.exe.dll (file missing)
O2 - BHO: (no name) - {A051B1FF-8D7E-418B-AABE-4FF82F4280A2} - C:\WINDOWS\system32\urqrpml.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKLM\..\Run: [MSDisp32] rundll32.exe C:\WINDOWS\system32\drvwon.dll,startup
O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\win1DD.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5921 bytes
On continue
Télécharge MSNFix.zip (!aur3n7) sur ton Bureau.
Décompresse-le sur ton bureau (Clique-Droit/Extraire tout).
Ouvre le dossier MSNFix puis double-clique sur MSNFix.bat.
- Exécute l'option R.
-- Si l'infection est détectée, presse une touche pour lancer le nettoyage.
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations.
Dans ce cas il suffit de redémarrer l'ordinateur manuellement.
Poste le rapport situé dans le dossier MSNFix.
Le nom du rapport correspond au moment de sa création : date_heure.log
Répondre à Angeldark
Re,
Désactive tes protections résidentes (antivirus...) !
Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous :
File::
|
Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
NOTE : S'il n'y a pas de rédémarrage, poste quand même les rapports demandés.
Répondre à Angeldark
analyse finie ! voilà le rapport d'Antivir 
AntiVir PersonalEdition Classic
Report file date: mardi 29 janvier 2008 20:38
Scanning for 1084249 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: UTILISAT-5836A4
Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 19:37:07
ANTIVIR2.VDF : 7.0.2.49 1339904 Bytes 25/01/2008 19:37:07
ANTIVIR3.VDF : 7.0.2.68 189440 Bytes 29/01/2008 19:37:07
AVEWIN32.DLL : 7.6.0.57 3215872 Bytes 29/01/2008 19:37:07
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 29/01/2008 19:37:07
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: mardi 29 janvier 2008 20:38
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'ATKKBService.exe' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'GamerOSD.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned
Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Starting to scan the registry.
The registry was scanned ( '29' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Propriétaire\Bureau\MSNFix\MSNFix\28012008_20154296.zip
[0] Archive type: ZIP
--> backup/mrofinu572.exe.tmp
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47cf80ff.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\1010[1].exe
[DETECTION] Is the Trojan horse TR/Delf.KH.12
[INFO] The file was moved to '47d0811b.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\CA6TTVZO
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47d5813b.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\css4[1]
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '48128170.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\css4[2]
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '48128172.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\spoolsv[1].exe
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '480e817b.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\css4[1]
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '481281d1.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\css4[2]
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '481281d3.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\VDAJ856R\css4[1]
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '48128200.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\VDAJ856R\css4[2]
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '48128201.qua'!
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\VDAJ856R\smss[1].exe
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '48128203.qua'!
C:\Program Files\Fichiers communs\AntivirusFiable\ugac.exe
[DETECTION] Is the Trojan horse TR/Spy.Agent.271360
[INFO] The file was moved to '4800820e.qua'!
C:\QooBox\Quarantine\C\Program Files\lsass.exe.vir
[DETECTION] Is the Trojan horse TR/Delf.KH.12
[INFO] The file was moved to '4800825a.qua'!
C:\QooBox\Quarantine\C\Program Files\smss.exe.vir
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '48128256.qua'!
C:\QooBox\Quarantine\C\Program Files\spoolsv.exe.vir
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '480e825b.qua'!
C:\QooBox\Quarantine\C\Program Files\Helper\Helper10.dll.vir
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '480b8252.qua'!
C:\QooBox\Quarantine\C\Program Files\Outerinfo\OiUninstaller.exe.vir
[DETECTION] Contains detection pattern of the dropper DR/PurityScan.GN.2
[INFO] The file was moved to '47f48258.qua'!
C:\QooBox\Quarantine\C\Program Files\Temporary\kernInst.exe.vir
[DETECTION] Is the Trojan horse TR/Agent.edq
[INFO] The file was moved to '48118256.qua'!
C:\QooBox\Quarantine\C\Temp\hKKsb1910.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.buy.47
[INFO] The file was moved to '47ea823d.qua'!
C:\QooBox\Quarantine\C\WINDOWS\17PHolmes572.exe.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47ef822b.qua'!
C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agent.hvj.1
[INFO] The file was moved to '47d18226.qua'!
C:\QooBox\Quarantine\C\WINDOWS\g2078000.exe.vir
[DETECTION] Is the Trojan horse TR/Dialer.ZZ
[INFO] The file was moved to '47cf8229.qua'!
C:\QooBox\Quarantine\C\WINDOWS\lsass.exe.vir
[DETECTION] Is the Trojan horse TR/Delf.KH.12
[INFO] The file was moved to '4800826b.qua'!
C:\QooBox\Quarantine\C\WINDOWS\mgrs.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.Alphabet.11264.53
[INFO] The file was moved to '48118261.qua'!
C:\QooBox\Quarantine\C\WINDOWS\mrofinu1000106.exe.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '480e826d.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drvwon.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '4815826f.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\nGpxx01\nGpxx011065.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.VB.cge
[INFO] The file was moved to '480f8246.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP12\A0001552.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47cf8237.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP13\A0001907.exe
[DETECTION] Is the Trojan horse TR/Dldr.Purity.BV.7
[INFO] The file was moved to '47cf8243.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP13\A0001916.exe
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '47cf8244.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP13\A0001922.exe
[DETECTION] Contains detection pattern of the dropper DR/PurityScan.GN.2
[INFO] The file was moved to '47cf8246.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP14\A0002268.dll
[DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo
[INFO] The file was moved to '47cf8253.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP14\A0002269.dll
[DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo
[INFO] The file was moved to '47cf8254.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP14\A0002271.dll
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '47cf8256.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP14\A0002272.dll
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '47cf8258.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP14\A0002273.dll
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '47cf825a.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002384.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47cf825f.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002385.exe
[DETECTION] Is the Trojan horse TR/Dldr.Agent.hvj.1
[INFO] The file was moved to '47cf8264.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002387.dll
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '47cf8265.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002388.exe
[DETECTION] Contains detection pattern of the dropper DR/PurityScan.GN.2
[INFO] The file was moved to '47cf826e.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002390.exe
[DETECTION] Is the Trojan horse TR/Agent.edq
[INFO] The file was moved to '47cf8270.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002391.exe
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '47cf8272.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002392.exe
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '47cf8274.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002395.exe
[DETECTION] Is the Trojan horse TR/Delf.KH.12
[INFO] The file was moved to '47cf8276.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002396.exe
[DETECTION] Is the Trojan horse TR/Dldr.Alphabet.11264.53
[INFO] The file was moved to '47cf8277.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002398.exe
[DETECTION] Is the Trojan horse TR/Delf.KH.12
[INFO] The file was moved to '47cf8278.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002404.exe
[DETECTION] Is the Trojan horse TR/Dldr.Alphabet.11264.53
[INFO] The file was moved to '47cf827a.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP16\A0002467.exe
[DETECTION] Is the Trojan horse TR/Dldr.Adload.PR.2
[INFO] The file was moved to '47cf827d.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP17\A0002508.exe
[DETECTION] Is the Trojan horse TR/Dldr.VB.cge
[INFO] The file was moved to '47cf8281.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP17\A0002510.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47cf8282.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP17\A0002511.exe
[DETECTION] Is the Trojan horse TR/Dialer.ZZ
[INFO] The file was moved to '47cf8284.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP17\A0002512.dll
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '47cf8285.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP18\A0002659.exe
[DETECTION] Is the Trojan horse TR/Spy.Agent.271360
[INFO] The file was moved to '47cf828b.qua'!
C:\System Volume Information\_restore{596FF071-05B0-4A0B-A5AF-AE86D1F40DF5}\RP7\A0000383.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47cf8295.qua'!
C:\VundoFix Backups\khfffdd.dll.bad
[DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo
[INFO] The file was moved to '480582d1.qua'!
C:\VundoFix Backups\qomnnmj.dll.bad
[DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo
[INFO] The file was moved to '480c82d9.qua'!
C:\VundoFix Backups\winjjq32.dll.bad
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '480d82d5.qua'!
C:\VundoFix Backups\winjks32.dll.bad
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '480d82d6.qua'!
C:\VundoFix Backups\winopn32.dll.bad
[DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
[INFO] The file was moved to '480d82d7.qua'!
End of the scan: mardi 29 janvier 2008 20:50
Used time: 11:42 min
The scan has been done completely.
2223 Scanning directories
60298 Files were scanned
59 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
59 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
60239 Files not concerned
800 Archives were scanned
1 Warnings
0 Notes
oui !! j'ai attendu un peu, pour voir si il n'y avait pas d'autres soucis qui se présentaient, ça a pas l'air... tous les problèmes ont disparu, ça marche impec ! Antivir fonctionne bien, tout va bien quoi ^^
merci pour tout 
Ok 
- Télécharge ToolsCleaner sur ton Bureau.
- Clique sur Recherche et laisse le scan se terminer.
- Clique sur Suppression pour finaliser.
- Clique sur Quitter, pour que le rapport puisse se créer.
- Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\)
Désactive puis réactive la restauration du système : Voir aide
Ajoute maintenant [Résolu] au titre. Pour cela :
* Clique, dans ton premier message, sur le bouton "Editer" 
* Rajoute la mention [Résolu] au titre
* Clique ensuite sur "Valider votre message"
Lis le dossier dossier sur la prévention et la protection pour ne plus avoir ce genre de problème en cliquant sur l'image ci-dessous :
Répondre à Angeldark
