Virus TR

Bonjour

Quel est le nom du fichier?

Poste moi le rapport de ton antivirus;merci.
@+

le nom du fichier est TR/ Vundo.4.8 et voici le rapport merci pour l'aide :)

Avira AntiVir Personal
Report file date: 8 novembre 2010 18:55

Scanning for 3022070 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows 7
Windows version : (plain) [6.1.7600]
Boot mode : Normally booted
Username : Système
Computer name : P111-INFOCOM-PC

Version information:
BUILD.DAT : 10.0.0.592 31823 Bytes 2010-08-09 11:00:00
AVSCAN.EXE : 10.0.3.1 434344 Bytes 2010-11-07 17:48:33
AVSCAN.DLL : 10.0.3.0 46440 Bytes 2010-04-01 17:57:04
LUKE.DLL : 10.0.2.3 104296 Bytes 2010-03-07 23:33:04
LUKERES.DLL : 10.0.0.1 12648 Bytes 2010-02-11 04:40:49
VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009-11-06 14:05:36
VBASE001.VDF : 7.10.1.0 1372672 Bytes 2009-11-19 00:27:49
VBASE002.VDF : 7.10.3.1 3143680 Bytes 2010-01-20 22:37:42
VBASE003.VDF : 7.10.3.75 996864 Bytes 2010-01-26 21:37:42
VBASE004.VDF : 7.10.4.203 1579008 Bytes 2010-03-05 16:29:03
VBASE005.VDF : 7.10.6.82 2494464 Bytes 2010-04-15 01:34:52
VBASE006.VDF : 7.10.7.218 2294784 Bytes 2010-06-02 01:34:53
VBASE007.VDF : 7.10.9.165 4840960 Bytes 2010-07-23 01:34:56
VBASE008.VDF : 7.10.11.133 3454464 Bytes 2010-09-13 14:59:31
VBASE009.VDF : 7.10.13.80 2265600 Bytes 2010-11-02 17:48:33
VBASE010.VDF : 7.10.13.81 2048 Bytes 2010-11-02 17:48:33
VBASE011.VDF : 7.10.13.82 2048 Bytes 2010-11-02 17:48:33
VBASE012.VDF : 7.10.13.83 2048 Bytes 2010-11-02 17:48:33
VBASE013.VDF : 7.10.13.116 147968 Bytes 2010-11-04 17:48:33
VBASE014.VDF : 7.10.13.147 146944 Bytes 2010-11-07 00:28:09
VBASE015.VDF : 7.10.13.148 2048 Bytes 2010-11-07 00:28:09
VBASE016.VDF : 7.10.13.149 2048 Bytes 2010-11-07 00:28:09
VBASE017.VDF : 7.10.13.150 2048 Bytes 2010-11-07 00:28:09
VBASE018.VDF : 7.10.13.151 2048 Bytes 2010-11-07 00:28:10
VBASE019.VDF : 7.10.13.152 2048 Bytes 2010-11-07 00:28:10
VBASE020.VDF : 7.10.13.153 2048 Bytes 2010-11-07 00:28:10
VBASE021.VDF : 7.10.13.154 2048 Bytes 2010-11-07 00:28:10
VBASE022.VDF : 7.10.13.155 2048 Bytes 2010-11-07 00:28:10
VBASE023.VDF : 7.10.13.156 2048 Bytes 2010-11-07 00:28:11
VBASE024.VDF : 7.10.13.157 2048 Bytes 2010-11-07 00:28:11
VBASE025.VDF : 7.10.13.158 2048 Bytes 2010-11-07 00:28:11
VBASE026.VDF : 7.10.13.159 2048 Bytes 2010-11-07 00:28:11
VBASE027.VDF : 7.10.13.160 2048 Bytes 2010-11-07 00:28:11
VBASE028.VDF : 7.10.13.161 2048 Bytes 2010-11-07 00:28:11
VBASE029.VDF : 7.10.13.162 2048 Bytes 2010-11-07 00:28:12
VBASE030.VDF : 7.10.13.163 2048 Bytes 2010-11-07 00:28:12
VBASE031.VDF : 7.10.13.164 2048 Bytes 2010-11-07 00:28:12
Engineversion : 8.2.4.92
AEVDF.DLL : 8.1.2.1 106868 Bytes 2010-08-13 01:35:04
AESCRIPT.DLL : 8.1.3.46 1364347 Bytes 2010-11-07 17:48:33
AESCN.DLL : 8.1.6.1 127347 Bytes 2010-08-13 01:35:03
AESBX.DLL : 8.1.3.1 254324 Bytes 2010-08-13 01:35:04
AERDL.DLL : 8.1.9.2 635252 Bytes 2010-09-25 17:09:28
AEPACK.DLL : 8.2.3.11 471416 Bytes 2010-10-11 16:03:47
AEOFFICE.DLL : 8.1.1.8 201081 Bytes 2010-08-13 01:35:02
AEHEUR.DLL : 8.1.2.38 2990455 Bytes 2010-11-07 17:48:33
AEHELP.DLL : 8.1.14.0 246134 Bytes 2010-10-11 16:02:26
AEGEN.DLL : 8.1.3.24 401781 Bytes 2010-11-07 17:48:33
AEEMU.DLL : 8.1.2.0 393588 Bytes 2010-08-13 01:35:01
AECORE.DLL : 8.1.17.0 196982 Bytes 2010-09-25 17:09:20
AEBB.DLL : 8.1.1.0 53618 Bytes 2010-08-13 01:35:01
AVWINLL.DLL : 10.0.0.0 19304 Bytes 2010-01-14 17:03:38
AVPREF.DLL : 10.0.0.0 44904 Bytes 2010-01-14 17:03:35
AVREP.DLL : 10.0.0.8 62209 Bytes 2010-02-18 21:47:40
AVREG.DLL : 10.0.3.2 53096 Bytes 2010-11-07 17:48:33
AVSCPLR.DLL : 10.0.3.1 83816 Bytes 2010-11-07 17:48:33
AVARKT.DLL : 10.0.0.14 227176 Bytes 2010-04-01 17:22:13
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 2010-01-26 14:53:30
SQLITE3.DLL : 3.6.19.0 355688 Bytes 2010-01-28 17:57:58
AVSMTP.DLL : 10.0.0.17 63848 Bytes 2010-03-16 20:38:56
NETNT.DLL : 10.0.0.0 11624 Bytes 2010-02-19 19:41:00
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 2010-01-28 18:10:20
RCTEXT.DLL : 10.0.58.0 97128 Bytes 2010-11-07 17:48:32

Configuration settings for the scan:
Jobname.............................: avguard_async_scan
Configuration file..................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_4d038c73\guard_slideup.avp
Logging.............................: low
Primary action......................: repair
Secondary action....................: quarantine
Scan master boot sector.............: on
Scan boot sector....................: off
Process scan........................: on
Scan registry.......................: off
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: high

Start of the scan: 8 novembre 2010 18:55

The scan of running processes will be started
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'DTShellHlp.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'TPCHSrv.exe' - '1' Module(s) have been scanned
Scan process 'TosSmartSrv.exe' - '1' Module(s) have been scanned
Scan process 'UNS.exe' - '1' Module(s) have been scanned
Scan process 'SteamService.exe' - '1' Module(s) have been scanned
Scan process 'DllHost.exe' - '1' Module(s) have been scanned
Scan process 'tosOBEX.exe' - '1' Module(s) have been scanned
Scan process 'TosAVRC.exe' - '1' Module(s) have been scanned
Scan process 'TosBtHsp.exe' - '1' Module(s) have been scanned
Scan process 'TosBtHid.exe' - '1' Module(s) have been scanned
Scan process 'TosA2dp.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RSelSvc.exe' - '1' Module(s) have been scanned
Scan process 'CFSvcs.exe' - '1' Module(s) have been scanned
Scan process 'raptr_im.exe' - '1' Module(s) have been scanned
Scan process 'CFIWmxSvcs.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'TosBtSrv.exe' - '1' Module(s) have been scanned
Scan process 'NDSTray.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'Xfire.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'raptr.exe' - '1' Module(s) have been scanned
Scan process 'TosBtMng.exe' - '1' Module(s) have been scanned
Scan process 'CursorFX.exe' - '1' Module(s) have been scanned
Scan process 'igfxext.exe' - '1' Module(s) have been scanned
Scan process 'steam.exe' - '1' Module(s) have been scanned
Scan process 'Babylon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'TUSBSleepChargeSrv.exe' - '1' Module(s) have been scanned
Scan process 'ThpSrv.exe' - '1' Module(s) have been scanned
Scan process 'Teco.exe' - '1' Module(s) have been scanned
Scan process 'TFPUTaskMonitor.exe' - '1' Module(s) have been scanned
Scan process 'TFPUPWDBank.exe' - '1' Module(s) have been scanned
Scan process 'TNROTATE.exe' - '1' Module(s) have been scanned
Scan process 'ltmoh.exe' - '1' Module(s) have been scanned
Scan process 'Apoint.exe' - '1' Module(s) have been scanned
Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
Scan process 'TCrdMain.exe' - '1' Module(s) have been scanned
Scan process 'SmoothView.exe' - '1' Module(s) have been scanned
Scan process 'TPwrMain.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'Explorer.EXE' - '1' Module(s) have been scanned
Scan process 'Dwm.exe' - '1' Module(s) have been scanned
Scan process 'taskhost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SDWinSec.exe' - '1' Module(s) have been scanned
Scan process 'WLIDSvcM.exe' - '1' Module(s) have been scanned
Scan process 'WLIDSVC.EXE' - '1' Module(s) have been scanned
Scan process 'TTPDSRV.exe' - '1' Module(s) have been scanned
Scan process 'TecoService.exe' - '1' Module(s) have been scanned
Scan process 'TosCoSrv.exe' - '1' Module(s) have been scanned
Scan process 'TODDSrv.exe' - '1' Module(s) have been scanned
Scan process 'ThpSrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sqlwriter.exe' - '1' Module(s) have been scanned
Scan process 'Student.exe' - '1' Module(s) have been scanned
Scan process 'sqlbrowser.exe' - '1' Module(s) have been scanned
Scan process 'sqlservr.exe' - '1' Module(s) have been scanned
Scan process 'sqlservr.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'LMS.exe' - '1' Module(s) have been scanned
Scan process 'conhost.exe' - '1' Module(s) have been scanned
Scan process 'avshadow.exe' - '1' Module(s) have been scanned
Scan process 'student.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'agrsmsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'AtService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned

Starting the file scan:

Begin scan in 'C:\Users\g@busb\AppData\Roaming\msihnd8.dll.VIR'
C:\Users\g@busb\AppData\Roaming\msihnd8.dll.VIR
[DETECTION] Is the TR/Vundo.4.8 Trojan
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26003
[WARNING] The file could not be deleted!
[NOTE] Attempting to perform action using the ARK library.
[NOTE] An ARK library instance is already running.

End of the scan: 8 novembre 2010 18:55
Used time: 00:10 Minute(s)

The scan has been done completely.

0 Scanned directories
598 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
597 Files not concerned
1 Archives were scanned
1 Warnings
1 Notes

The scan results will be transferred to the Guard.

Bonjour

Trouve ce fichier et supprime le.
C:\Users\g@busb\AppData\Roaming\msihnd8.dll.VIR'

Pour afficher les fichiers cachés:
http://www.chantal11.com/...

@+

Ca ne marche pas il est toujour invisible (cacher) :'(

Bonjour

je ne veux pas être méchant;mais Google:

http://www.forum-seven.com/forum/

@+

Toujour rien le dossier reste cacher :(

Bonjour

Bizarre...

Télécharge SEAF.exe de C_XX a cette adresse :
https://www.androidworld.fr/

*Double clique sur SEAF.exe ("exécuter en tant qu'administrateur pour vista ou seven) .

*Une fenêtre va s'ouvrir.

Dans les options, règle "Calculer le checksum" sur "MD5" puis coche "Informations supplémentaires" et "Chercher également dans le Registre".

*Tape : msihnd8.dll.VIR

Il y a un point virgule entre chaque terme.
et ensuite du clique sur le bouton "Lancer la recherche" .

*Patiente pendant la recherche.

*Une fenêtre avec un log .txt va s'afficher.

*Copie/colle ce rapport dans ta prochaine réponse.

Tuto :
http://www.teamxscript.org/SEAFRecherche.html

@+

========================= SEAF 1.0.1.0 - C_XX
2.
3. Commencé à: 17:06:07 le 18/11/2010
4.
5. Valeur(s) recherchée(s):
6. msihnd8.dll.VIR
7.
8. Légende: TC => Date de création, TM => Date de modification, DA => Dernier accès
9.
10. (!) --- Calcul du Hash "MD5"
11. (!) --- Informations supplémentaires
12. (!) --- Recherche registre
13.
14. ====== Fichier(s) ======
15.
16.
17. "C:\Users\g@busb\AppData\Roaming\msihnd8.dll.VIR" [ ARCHIVE|SYSTEM|HIDDEN|READONLY | 55 Ko ]
18. TC: 21/10/2010,15:49:13 | TM: 21/10/2010,15:49:13 | DA: 12/11/2010,16:57:41
19.
20. Hash MD5: [Impossible à obtenir]
21.
22.
23. =========================
24.
25.
26.
27. ====== Entrée(s) du registre ======
28.
29. Aucun élément dans le registre trouvé
30.
31. =========================
32.
33. Fin à: 17:11:00 le 18/11/2010
34. 454755 Éléments analysés
35.
36. =========================
37. E.O.F

Bonjour

Et pourtant ;il est bien là.

Donc reprend la procédure pour afficher les fichiers cachés et les fichiers système.

@+

oui ca marche il est la :) mais il me dise que j'ai besoin de la permision de p-111 infocom-PC\g@busb mais je suis sur g@busb !

Bonsoir

Tu n'es pas administrateur du PC?
C'est cela?

@+

le pc est a moi et les deux utulisateur sont administrateur (1 pour l'école et l'autre pour la maison) et avec les deux sa ne marche pas meme en mode sans échec !

Bonsoir

Si tu le dis.
Et bien ignore ce fichier ;il ne peut rien te faire.

@+

...Ben il m'enpeche de joué a sertais jeux pis de faire des update ou d'installer des logicielles pis quant je l'ouvre il montre 5ou6 page d'erreur window !!!!

Bonjour

Cela est bien mentionné quelque part.
Cherche un peu .
Une facture ou sinon dans le PC ;dans la configuration du système.

https://www.commentcamarche.net/informatique/windows/139-ouvrir-le-panneau-de-configuration-dans-windows-10/

@+

Bonsoir

Et bien passons à cet utilitaire costaud.

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Ou ici : https://forospyware.com
>Renomme le pour l'enregistrer sur ton bureau en asdehi (tout simplement pour que l'infection ne le contre pas)
-> Double clique combofix.exe.(ou clic droit sous vista « exécuter en tant que... » )
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'Internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe ; (ou clic droit sous vista « exécuter en tant que... »)

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

- Installe le console de récupération comme demandé ;utile en cas de plantage

- Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programme. Risque de figer l'ordinateur

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordinateur (plantage complet)

::Si combofix détecte quelque chose et de demande a redémarrer tu acceptes

@+

encore une défaite :( car qu'and je l'instale je dois fermer une trantaine de page d'ereur window puis il me sorte que window ne peuvent pas ouvrir le fichier nircmd.cfxxe (aucune idée ces quoi )

Bonsoir

Et avec un clic droit de la souris?

@+

même choses :'(

Bonjour

Sauvegarde toutes tes données importantes et restaure en version sortie usine si cette partition de sauvegarde existe.

@+