salut!

yaurait il quelqun (genre evilelf) pour m´analyser un log hijackthis svp car mon pc foire là.

merci.

Salut,

C´est à dire il foire ? Envoie tout log, on verra bien.

bah j´ai eut un truc chelou avec msn hier, des mails étaient envoyés tout seul à mes contacts, et j´ai fait un coup de msnfix, qui a nettoyé. Mais je viens de merendre compte que ça l´a fait aussi avec mon mail yahoo.

en plus ma connection foire.

mon log:

Logfile of HijackThis v1.99.1
Scan saved at 20:31:15, on 18/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\ASWLSVC.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Razer\Diamondback\razerhid.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Fichiers communs\Logitech\LCD Manager\lcdmon.exe
C:\Program Files\Fichiers communs\Logitech\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Fichiers
communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Fichiers communs\Logitech\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Razer\Diamondback\razertra.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\benjamin\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback\razerhid.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [CTXFIREG] CTxfiReg.exe
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Fichiers communs\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers
communs\LogiShrd\LComMgr\Communications_Helper.exe
"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: WD Backup Monitor.lnk = C:\Program Files\My Book\WD Backup\uBBMonitor.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra ´Tools´ menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ´Tools´ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) -
http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) -
http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165257995064
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) -
http://www.creative.com/su/ocx/15033/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nb) (pr2ah4nb) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nb.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

j´dois avoir le même problème que toi

Re,

Rien de louche dans le rapport. Quel genre de mail ? C´est plutôt étrange.

En tout cas, commence par ceci :

Avast! est loin de ce que l´on a fait de mieux en matière de protection, voir ce lien pour plus d´informations :
http://forum.malekal.com/ftopic3123.php

Clairement, Antivir est beaucoup plus performant, c´est pourquoi, je te conseille TRES VIVEMENT de désinstaller Avast!
http://www.avast.com/fre/e/avast-uninstall-utility.html
et installer Antivir à la place :
http://www.clubic.com/telecharger-fiche10821-antivir-personal-edition-7.html
Tuto :
http://www.malekal.com/tutorial_antivir.php
- Après l´installation, mets le à jour - si ton firewall fait une alerte.. accepte la connexion.
- Assure toi qu´Antivir est bien à jour, vérifie la date d´update.

-- Redémarre en mode sans échec, pour cela, redémarre l´ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

- Ouvre Antivir par le menu Démarrer / Programmes
- Cliquez sur l´onglet Scanner.
- Sélectionne Manual Selection
- Sélectionne le disque C
- Lance le scan - Mets en quarantaine tous les éléments détectés.
- Une fois le scan terminé Enregistre le rapport.

Redémarre en mode normal.

Poste le rapport ici.

Genre un mail qui balançait un lien vers un site qui vend des machjins, c´était en anglais, j´ai pas tout capté

je suis vraiment obligé de virer avast et de balancer un scan antivir?

je dl rien, je vais pas sur des sites cochons, avast me suffit je pense

si on pouvait omettre cette étape ce serait cool

En attendant t´as un problème, et je ne vois encore d´où ça pourrait venir. Le pourriel en général c´est pas toi l´envoie, mais tu le reçois

Avast ne suffit pas, quelque soit la personne et ses habitudes. Avast est bien trop lent à intégrer les nouvelles infections, il est inutile. C´est le moment d´en changer et d´opter pour un antivirus beaucoup beaucoup plus performant qu´est Antivir.

Qu´a nettoyé msnfix aussi ?

voilà le rapport de msnfix:

MSNFix 1.605

C:\Documents and Settings\benjamin\Bureau\MSNFix
Fix exécuté le 17/12/2007 - 22:48:05,34 By benjamin
mode normal

• • ********************* Recherche les fichiers présents

Aucun Fichier trouvé

• • ********************* Recherche les dossiers présents

... C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP\

• • ********************* Suppression des fichiers

• • ********************* Suppression des dossiers

.. OK ... C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP\

• • ********************* Nettoyage du registre

• • ********************* Fichiers suspects

Aucun Fichier trouvé

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 17122007_22494614.zip

--------------------------------------------------

----------------------
Auteur : !a ur3n7 Contact:
http://changelog.fr

--------------------------------------------------

----------------------

--------------------------------------------- END ---------------------------------------------

Okay donc il a rien trouvé en fait

Ce n´est pas une infection implanté au système. Le spam ça ne se guéri pas, hormis avec des règles de filtrages, avec thunderbird par exemple. Sinon, c´est pas compliqué, éviter de laisser son adresse sur le net, que ce soit blog, forum etc ... Et ne jamais cliquer, ou répondre à un pourriel. En revanche, ce qui m´étonne, c´est que c´est toi qui les envoies

C´est quel genre de messages ? Quelqu´un utilise ton adresse ?

commence par Antivir.

je commence par antivir alors.

bah nan je pense pas que quelqun utilise mon adresse, parce que ça l´a fait sur mes deux adresses, si on a pu choper mes deux adresses mail alors j´imagine pas le reste :s

antivir arrive pas à se mettre à jour...

je lance quand même le scan...

c´et bon il y est parvenu, je scanne

je suis claqué et le scanne est long, je ferai ça demain

Pas de problème, bonne nuit !

et antivir m´a trouve un joli trojan il a tout viré

Je poste le rapport en deux fois.

AntiVir PersonalEdition Classic
Report file date: mercredi 19 décembre 2007 07:28

Scanning for 980737 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: BENJAMIN-35C519

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 20:11:57
ANTIVIR2.VDF : 7.0.1.96 2048 Bytes 14/12/2007 20:11:57
ANTIVIR3.VDF : 7.0.1.118 110592 Bytes 18/12/2007 06:28:23
AVEWIN32.DLL : 7.6.0.45 3084800 Bytes 18/12/2007 20:11:57
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercredi 19 décembre 2007 07:28

The scan of running processes will be started
Scan process ´avscan.exe´ - ´1´ Module(s) have been scanned
Scan process ´avcenter.exe´ - ´1´ Module(s) have been scanned
Scan process ´razerofa.exe´ - ´1´ Module(s) have been scanned
Scan process ´razertra.exe´ - ´1´ Module(s) have been scanned
Scan process ´ctfmon.exe´ - ´1´ Module(s) have been scanned
Scan process ´avgnt.exe´ - ´1´ Module(s) have been scanned
Scan process ´rundll32.exe´ - ´1´ Module(s) have been scanned
Scan process ´rundll32.exe´ - ´1´ Module(s) have been scanned
Scan process ´razerhid.exe´ - ´1´ Module(s) have been scanned
Scan process ´zlclient.exe´ - ´0´ Module(s) have been scanned
Scan process ´jusched.exe´ - ´1´ Module(s) have been scanned
Scan process ´Center.exe´ - ´1´ Module(s) have been scanned
Scan process ´alg.exe´ - ´1´ Module(s) have been scanned
Scan process ´LVComSer.exe´ - ´1´ Module(s) have been scanned
Scan process ´svchost.exe´ - ´1´ Module(s) have been scanned
Scan process ´nvsvc32.exe´ - ´1´ Module(s) have been scanned
Scan process ´LVComSer.exe´ - ´1´ Module(s) have been scanned
Scan process ´guard.exe´ - ´1´ Module(s) have been scanned
Scan process ´ATKKBService.exe´ - ´1´ Module(s) have been scanned
Scan process ´ASWLSVC.exe´ - ´1´ Module(s) have been scanned
Scan process ´sched.exe´ - ´1´ Module(s) have been scanned
Scan process ´avguard.exe´ - ´1´ Module(s) have been scanned
Scan process ´LVPrcSrv.exe´ - ´1´ Module(s) have been scanned
Scan process ´spoolsv.exe´ - ´1´ Module(s) have been scanned
Scan process ´explorer.exe´ - ´1´ Module(s) have been scanned
Scan process ´vsmon.exe´ - ´0´ Module(s) have been scanned
Scan process ´svchost.exe´ - ´1´ Module(s) have been scanned
Scan process ´svchost.exe´ - ´1´ Module(s) have been scanned
Scan process ´svchost.exe´ - ´1´ Module(s) have been scanned
Scan process ´svchost.exe´ - ´1´ Module(s) have been scanned
Scan process ´svchost.exe´ - ´1´ Module(s) have been scanned
Scan process ´svchost.exe´ - ´1´ Module(s) have been scanned
Scan process ´lsass.exe´ - ´1´ Module(s) have been scanned
Scan process ´services.exe´ - ´1´ Module(s) have been scanned
Scan process ´winlogon.exe´ - ´1´ Module(s) have been scanned
Scan process ´csrss.exe´ - ´1´ Module(s) have been scanned
Scan process ´smss.exe´ - ´1´ Module(s) have been scanned
35 processes with 35 modules were scanned

Start scanning boot sectors:
Boot sector ´C:\´
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( ´29´ files ).

Starting the file scan:

Begin scan in ´C:\´
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP457\A0084966.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c5c9.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP459\A0085111.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c5d2.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP459\A0085392.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c5e8.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP460\A0085440.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c5eb.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP461\A0085619.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c5f3.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP462\A0085892.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c748.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP462\A0085954.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c749.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP463\A0086021.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c756.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP464\A0086505.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c762.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP465\A0086614.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c766.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP465\A0086671.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c768.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP466\A0086766.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c76b.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP466\A0086933.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c770.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP467\A0087048.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c774.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP468\A0087126.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c778.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP468\A0087146.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4765af01.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP470\A0087288.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c77e.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP471\A0087318.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c780.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP472\A0087434.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c785.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP473\A0087534.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c788.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP474\A0087652.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c78d.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP476\A0088147.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c79d.qua´!

C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP477\A0088356.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c7a3.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP477\A0088664.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c7ab.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP478\A0088743.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c813.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP478\A0088761.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4765a06c.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP479\A0088841.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c817.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP480\A0089073.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c81d.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP481\A0089190.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c821.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP481\A0089287.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c824.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP482\A0089304.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c825.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP482\A0089357.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c827.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP484\A0089429.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c82b.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP484\A0089487.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c82d.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP485\A0089609.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c830.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP486\A0089741.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c834.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP486\A0089768.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c835.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP487\A0089879.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c839.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP488\A0089940.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c83c.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP489\A0090141.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c842.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP491\A0090211.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c846.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP503\A0090495.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c855.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP520\A0090906.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c86a.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP523\A0090981.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c86e.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP526\A0091085.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c873.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP527\A0091202.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c877.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP527\A0091258.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c878.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP528\A0091412.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c87e.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP528\A0091440.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c87f.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP529\A0091650.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c885.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP531\A0091790.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c88d.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP533\A0092076.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c8ed.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP534\A0092121.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c8f0.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP534\A0092356.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c8f8.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP535\A0092490.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c8fc.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP535\A0092876.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c906.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP535\A0093004.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c90a.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP538\A0093159.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c910.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP539\A0093329.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c916.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP540\A0093497.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c91c.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP541\A0093521.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c91e.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP542\A0093676.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c924.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP543\A0093932.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c981.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP544\A0094221.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c98a.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP544\A0094726.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c997.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP545\A0094822.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c99a.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP545\A0095135.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c9a1.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP545\A0095251.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c9a4.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP545\A0095330.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c9a7.qua´!
C:\System Volume
Information\_restore{DCEAC9A3-9265-42C9-8742-864B3
BCE6218}\RP546\A0095428.dll
[DETECTION] Is the Trojan horse TR/Gorshok.A
[INFO] The file was moved to ´4798c9ab.qua´!
End of the scan: mercredi 19 décembre 2007 08:44
Used time: 1:15:26 min

The scan has been done completely.

7990 Scanning directories
387308 Files were scanned
70 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
70 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
387238 Files not concerned
2822 Archives were scanned
1 Warnings
1 Notes

A vrai dire tu n´es pas du tout infecté, Antivir et Kaspersky détecte le fichier C:\Program Files\Alwil Software\Avast4\DATA\clnr0.dll comme étant un trojan, en fait c´est simplement un faux positif !

Fais juste ceci :

Désactives ta restauration système :

Clique droit sur poste de travail / propriétés / onglet restauration du système : coche la case "désactiver la restauration système sur tous les lecteurs."
Clique sur "Appliquer", et "ok".

Puis réactive ta restauration système :

Clique droit sur poste de travail / propriétés / onglet restauration du système : décoche la case "désactiver la restauration système sur tous les lecteurs."
Clique sur "Appliquer", et "ok".

Ensuite crée un nouveau point de restauration :
Menu démarrer / tous les programmes / accessoires / outils système / restauration du système / "créer un nouveau point de restauration"

ok d´accord, mais ça nrésoud pas mon pb d´emails suspect... tu crois qu´on m´a hacké?

A vrai dire je n´en sais rien, et je ne pense pas pouvoir résoudre ton problème, étant donné que je détecte aucune infection ... Le spam ça ne guérie pas vraiment.