Bonjour,

C'est la première fois que je poste sur ce forum, mon pc a été infecté par le virus win 32 rootkit gen il y a 2 jours. J'ai fait des recherches et ai viré avast (que j'avais) et remplacé par antivir. Là j'ai procédé à polusieurs scans: CCleaner, puis Spybot, puis 2 scans avec antivir (mais sans passer par le mode sans échec). Actuellement je n'ai plus d'alertes windows. Mais cela me paraît un peu trop facile, j'ai retrouvé mon fond d'écran mais les dossiers sur mon bureau restent cadrés de bleu (???). Donc là j'ai 3 questions.

1. Comment être sûre que mon pc a été bien nettoyé??? Je poste plus bas les 2 rapports de scan d'antivir si quelqu'un peut les "décrypter".
2. J'ai lu que CCleaner et antivir n'étaient pas trop compatibles, j'ai la version v2.00.500 et antivir n'apparaît pas dans les utilitaires pour le décocher lors des scans.
3. Un disque dur externe était branché lors de l'infection, peut-il avoir été touché?? Sachant que mon pc a un disque interne réparti en 2 le C et le D, et que le virus s'est mis de suite dans le C.

Je n'ai pas osé utilisé hijack car je m'y connais peu en informatique et j'avais peur de faire une bêtise avec.

Voici les rapports d'antivir.
Le premier:

Avira antivir Personal
Report file date: jeudi 21 août 2008 13:03

Scanning for 1565750 virus strains and unwanted programs.

Licensed to: Avira antivir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: NOM-2FA7407801F

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 10:55:56
ANTIVIR2.VDF : 7.0.6.10 2587136 Bytes 14/08/2008 10:56:12
ANTIVIR3.VDF : 7.0.6.47 205312 Bytes 21/08/2008 10:56:14
Engineversion : 8.1.1.23
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.68 315770 Bytes 21/08/2008 10:56:29
AESCN.DLL : 8.1.0.23 119156 Bytes 21/08/2008 10:56:28
AERDL.DLL : 8.1.0.20 418165 Bytes 21/08/2008 10:56:27
AEPACK.DLL : 8.1.2.1 364917 Bytes 21/08/2008 10:56:26
AEOFFICE.DLL : 8.1.0.22 192890 Bytes 21/08/2008 10:56:24
AEHEUR.DLL : 8.1.0.50 1388918 Bytes 21/08/2008 10:56:23
AEHELP.DLL : 8.1.0.15 115063 Bytes 21/08/2008 10:56:19
AEGEN.DLL : 8.1.0.36 315764 Bytes 21/08/2008 10:56:19
AEEMU.DLL : 8.1.0.7 430452 Bytes 21/08/2008 10:56:17
AECORE.DLL : 8.1.1.8 172406 Bytes 21/08/2008 10:56:16
AEBB.DLL : 8.1.0.1 53617 Bytes 21/08/2008 10:56:15
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 8.0.0.2 98344 Bytes 21/08/2008 10:56:14
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan Memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 21 août 2008 13:03

Starting search for hidden objects.
'63331' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process '.ttC.tmp' - '1' Module(s) have been scanned
Module is infected -> 'C:\Documents and Settings\Layla\Local Settings\Temp\.ttC.tmp'
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
Scan process 'Toaster.exe' - '1' Module(s) have been scanned
Scan process 'HKWnd.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'VPbubble.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'VzFw.exe' - '1' Module(s) have been scanned
Scan process 'ApntEx.exe' - '1' Module(s) have been scanned
Scan process 'VzCdbSvc.exe' - '1' Module(s) have been scanned
Scan process 'VCSW.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'TrayMin200.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'acrotray.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'lphc3f8j0eaaa.exe' - '1' Module(s) have been scanned
Module is infected -> 'C:\WINDOWS\system32\lphc3f8j0eaaa.exe'
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'VM_STI.EXE' - '1' Module(s) have been scanned
Scan process 'pdservice.exe' - '1' Module(s) have been scanned
Scan process 'VAIOUpdt.exe' - '1' Module(s) have been scanned
Scan process 'HKServ.exe' - '1' Module(s) have been scanned
Scan process 'SPMgr.exe' - '1' Module(s) have been scanned
Scan process 'ico.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Apoint.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
Process '.ttC.tmp' has been terminated
Process 'lphc3f8j0eaaa.exe' has been terminated
C:\Documents and Settings\Layla\Local Settings\Temp\.ttC.tmp
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[NOTE] The file was moved to '49214ceb.qua'!
C:\WINDOWS\system32\lphc3f8j0eaaa.exe
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.pjv Backdoor server programs
[NOTE] The file was moved to '49154cea.qua'!

61 processes with 59 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
C:\WINDOWS\system32\sysrest32.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[NOTE] TR/Crypt.XPACK.Gen:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]:<sysrest32.exe>=sz:sysrest32.exe
[NOTE] The file was moved to '49204cf9.qua'!

The registry was scanned ( '41' files ).


Starting the file scan:

Begin scan in 'C:\' <VAIO>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The fund was classified as suspicious.
[NOTE] The file was moved to '49164dd2.qua'!
C:\Program Files\Sony\MyInfoCentre\ISP\ISP021\DialBBSignUp.exe
[DETECTION] Contains detection pattern of the dial-up program DIAL/270336
[NOTE] The file was moved to '490e56f3.qua'!
C:\System Volume Information\_restore{58244814-5EDF-4690-86B6-2EB4FBC94F1B}\RP266\A0183373.exe
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.pjv Backdoor server programs
[NOTE] The file was moved to '48de58ab.qua'!
C:\System Volume Information\_restore{58244814-5EDF-4690-86B6-2EB4FBC94F1B}\RP266\A0183374.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[NOTE] The file was moved to '495f8c4c.qua'!
C:\System Volume Information\_restore{58244814-5EDF-4690-86B6-2EB4FBC94F1B}\RP266\A0183375.exe
[DETECTION] Contains detection pattern of the dial-up program DIAL/270336
[NOTE] The file was moved to '48de58ad.qua'!
C:\WINDOWS\system32\ftp.exe
[DETECTION] Is the Trojan horse TR/Agent.49664.J
[NOTE] The file was moved to '491d5dbd.qua'!
Begin scan in 'D:\' <VAIO>


End of the scan: jeudi 21 août 2008 14:24
Used time: 1:20:50 min

The scan has been done completely.

8814 Scanning directories
205606 Files were scanned
10 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
0 files were deleted
0 files were repaired
9 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
205596 Files not concerned
9078 Archives were scanned
3 Warnings
9 Notes
63331 Objects were scanned with rootkit scan
0 Hidden objects were found

Et le 2ème effectué quelques minutes plus tard et qui a encore détecté une infection:

Avira antivir Personal
Report file date: jeudi 21 août 2008 14:40

Scanning for 1565750 virus strains and unwanted programs.

Licensed to: Avira antivir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: NOM-2FA7407801F

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 10:55:56
ANTIVIR2.VDF : 7.0.6.10 2587136 Bytes 14/08/2008 10:56:12
ANTIVIR3.VDF : 7.0.6.47 205312 Bytes 21/08/2008 10:56:14
Engineversion : 8.1.1.23
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.68 315770 Bytes 21/08/2008 10:56:29
AESCN.DLL : 8.1.0.23 119156 Bytes 21/08/2008 10:56:28
AERDL.DLL : 8.1.0.20 418165 Bytes 21/08/2008 10:56:27
AEPACK.DLL : 8.1.2.1 364917 Bytes 21/08/2008 10:56:26
AEOFFICE.DLL : 8.1.0.22 192890 Bytes 21/08/2008 10:56:24
AEHEUR.DLL : 8.1.0.50 1388918 Bytes 21/08/2008 10:56:23
AEHELP.DLL : 8.1.0.15 115063 Bytes 21/08/2008 10:56:19
AEGEN.DLL : 8.1.0.36 315764 Bytes 21/08/2008 10:56:19
AEEMU.DLL : 8.1.0.7 430452 Bytes 21/08/2008 10:56:17
AECORE.DLL : 8.1.1.8 172406 Bytes 21/08/2008 10:56:16
AEBB.DLL : 8.1.0.1 53617 Bytes 21/08/2008 10:56:15
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 8.0.0.2 98344 Bytes 21/08/2008 10:56:14
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan Memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 21 août 2008 14:40

Starting search for hidden objects.
'63205' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
Scan process 'Toaster.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'TrayMin200.exe' - '1' Module(s) have been scanned
Scan process 'VPbubble.exe' - '1' Module(s) have been scanned
Scan process 'acrotray.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'HKWnd.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'ApntEx.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'VM_STI.EXE' - '1' Module(s) have been scanned
Scan process 'pdservice.exe' - '1' Module(s) have been scanned
Scan process 'VAIOUpdt.exe' - '1' Module(s) have been scanned
Scan process 'HKServ.exe' - '1' Module(s) have been scanned
Scan process 'SPMgr.exe' - '1' Module(s) have been scanned
Scan process 'ico.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Apoint.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'VzFw.exe' - '1' Module(s) have been scanned
Scan process 'VzCdbSvc.exe' - '1' Module(s) have been scanned
Scan process 'VCSW.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
56 processes with 56 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '40' files ).


Starting the file scan:

Begin scan in 'C:\' <VAIO>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{58244814-5EDF-4690-86B6-2EB4FBC94F1B}\RP266\A0183376.exe
[DETECTION] Is the Trojan horse TR/Agent.49664.J
[NOTE] The file was moved to '48de8206.qua'!
Begin scan in 'D:\' <VAIO>


End of the scan: jeudi 21 août 2008 17:13
Used time: 2:33:12 min

The scan has been done completely.

8811 Scanning directories
205559 Files were scanned
1 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
1 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
205558 Files not concerned
9078 Archives were scanned
3 Warnings
1 Notes
63205 Objects were scanned with rootkit scan
0 Hidden objects were found

Et enfin, j'ai fait un scan en ligne avec "trend micro" et il a juste trouvé des cookies. Mon pc est-il toujours infecté?? Merci de vos réponses, je repasse dans la matinée pour voir.

Lali26,

Si le Win 32 rootkit trouvé par avast pointait sur le fichier SvcHost.
Alors il s'agissait d'une erreur d'Avast, qui est amplement répertoirié sur le net.


Ajouter Malwarebyres (spyware. malware) à vos logiciels de détection, il est super efficace.
Utile dans sa version gratuite, pour un scan au besion ou préventif.
Télécharger Malwarebytes : http://www.malwarebytes.org/mbam.php
Tutoriel Malwarebytes.
Installer / mettez à jours Malwarebytes.
Redémarrer en mode sans échec (au logo du Bios appuyer à répétition sur F8 ou F5) et lancer un scan "Complet", lorsque terminé cocher "Supprimer la sélection".

Le pouvoir de détection d'Antivir associé à Malwarebytes et quelques scan en ligne Trend micro, Kaspersky..
Fait que si aucune infection n'est trouvée, ça devrait être no problemo !

Bonjour Mido,

J'ai effectivement lu cette info sur avast mais APRES l'avoir supprimé donc je ne sais pas quels fichiers étaient pointés (il y en avait plusieurs). En plus j'avais aussi des malware dtéectés (et le tout confirmé par Spybot) donc je ne suis pas sûre qu'il s'agissait bien de cette fameuse erreur d'avast.

Et j'avais oublié de préciser que j'ai aussi utilisé avg (avant de mettre antivir et de virer avast) qui n'avait rien décelé à ce moment-là alors que antivir, par la suite,si! Je vais mettre Malwarebytes et scanner, on verra le résultat. Merci de ce conseil.

Par contre si quelqu'un en sait plus si la compatibilté CCleaner et antivir, cela m'aiderait beaucoup!!

Lali26,

Était-ce AVG 8, soit la dernière version que vous aviez installé et qui n'avait pas détecté..

Pour AVG c'est la version 7.5 par contre elle est mise à jour très régulièrement. Je vais la remettre encore à jour et scanner de suite...

Sinon j'ai fais le scan avec Malwarebytes et encore 4 fichiers infectés... Je ne sais pas si le compte rendu du scan peut aider à comprendre, je les mets en dessous au cas où. J'avoue ne plus savoir que faire, car scanner sans arrêt n'est peut être pas la solution?? Et comment être sûre que le pc soit réellement nettoyé??

le scan de Malwarebytes:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1076
Windows 5.1.2600 Service Pack 2

13:31:16 22/08/2008
mbam-log-08-22-2008 (13-31-16).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 118081
Temps écoulé: 2 hour(s), 48 minute(s), 17 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc3f8j0eaaa (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Florent\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

Je pars travailler et reviens ce soir, toute aide est la bienvenue, merci d'avance.

Lali26,

Si vous vous enlignez pour ré-installer AVG 7.5.

Faites le plutôt avec la version 8 d'AVG antivirus, qui vient avec un antispyware intégré.

Téléchargement AVG Anti-Virus Free Edition 8.0 : http://free.avg.com/ww.download?prd=afe

Bonjour,

Je crois que mon problème est réolu.

J'ai mis AVG version 8, qui n'a rien détecté. Dans la foulée j'ai scanné avec Malwarebytes en mode sans échec et cette fois aucune infection. Donc je pense que c'est bon, je reste un peu étonnée car ce que j'ai lu sur ce virus me faisait croire qu'il était plus coriace que ça.

Un grand merci pour vos conseils, cela m'a bien aidée et bravo pour ce site qui va devenir une référence pour moi!

Bon week end!