Virus W32.myzor.FK@yf

Question

bonjour , je demande votre aide car infecté par le virus W32.mon ordinateur est infecté par le virus WIN32.MYZOR.FK@YF.  Après avoir lu les questions et réponses de certains utilisateurs sur ce forum ayant eu le même probleme pourriez vous résoudre le mien . D'avance je vous remercie  de votre aide.---------------------------------------------------------ewido anti-spyware - Scan Report--------------------------------------------------------- + Created at:	08:33:34 19/09/2006 + Scan result:	C:\Program Files\Virus-Burst -> Adware.Generic : Cleaned with backup (quarantined).C:\Documents and Settings\bidule\Cookies\bidule@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@estat[1].txt -> TrackingCookie.Estat : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.C:\Documents and Settings\bidule\Cookies\bidule@weborama[2].txt -> TrackingCookie.Weborama : Cleaned.::Report endBitDefender Online Scanner     Scan report generated at: Tue, Sep 19, 2006 - 09:05:52       Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;           Statistics Time 00:25:23 Files 299465 Folders 3704 Boot Sectors 4 Archives 8549 Packed Files 28022      Results Identified Viruses  5 Infected Files  13 Suspect Files  0 Warnings 0 Disinfected 0 Deleted Files 13      Engines Info Virus Definitions 454856 Engine build AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38) Scan plugins 13 Archive plugins 38 Unpack plugins 6 E-mail plugins 6 System plugins 1      Scan Settings First Action Disinfect Second Action Delete Heuristics Yes Enable Warnings Yes Scanned Extensions *; Exclude Extensions   Scan Emails Yes Scan Archives Yes Scan Packed Yes Scan Files Yes Scan Boot Yes        Scanned File  Status C:\Program Files\strCodec\iesuninst.exe Infected with: Trojan.Downloader.Zlob.ATU C:\Program Files\strCodec\iesuninst.exe Disinfection failed C:\Program Files\strCodec\iesuninst.exe Deleted C:\Program Files\strCodec\isamini.exe Infected with: Trojan.Zlob.CE C:\Program Files\strCodec\isamini.exe Disinfection failed C:\Program Files\strCodec\isamini.exe Deleted C:\Program Files\strCodec\isamonitor.exe Infected with: Trojan.Zlob.CE C:\Program Files\strCodec\isamonitor.exe Disinfection failed C:\Program Files\strCodec\isamonitor.exe Deleted C:\Program Files\strCodec\isauninst.exe Infected with: Trojan.Downloader.Zlob.ATU C:\Program Files\strCodec\isauninst.exe Disinfection failed C:\Program Files\strCodec\isauninst.exe Deleted C:\Program Files\strCodec\pmmon.exe Infected with: Trojan.Downloader.Zlob.ARU C:\Program Files\strCodec\pmmon.exe Disinfection failed C:\Program Files\strCodec\pmmon.exe Deleted C:\Program Files\strCodec\pmsngr.exe Infected with: Trojan.Downloader.Zlob.XM C:\Program Files\strCodec\pmsngr.exe Disinfection failed C:\Program Files\strCodec\pmsngr.exe Deleted C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP7\A0001322.dll Infected with: Trojan.FakeAlert.DE C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP7\A0001322.dll Disinfection failed C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP7\A0001322.dll Deleted C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001633.exe Infected with: Trojan.Downloader.Zlob.ATU C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001633.exe Disinfection failed C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001633.exe Deleted C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001634.exe Infected with: Trojan.Zlob.CE C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001634.exe Disinfection failed C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001634.exe Deleted C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001635.exe Infected with: Trojan.Zlob.CE C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001635.exe Disinfection failed C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001635.exe Deleted C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001636.exe Infected with: Trojan.Downloader.Zlob.ATU C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001636.exe Disinfection failed C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001636.exe Deleted C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001637.exe Infected with: Trojan.Downloader.Zlob.ARU C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001637.exe Disinfection failed C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001637.exe Deleted C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001638.exe Infected with: Trojan.Downloader.Zlob.XM C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001638.exe Disinfection failed C:\System Volume Information\_restore{A7AE9385-5787-4AEE-A116-EDEB56850218}\RP8\A0001638.exe Deleted       Logfile of HijackThis v1.99.1Scan saved at 09:31:03, on 19/09/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\RTHDCPL.EXEC:\Program Files\Fichiers communs\Intel\IntelDH\NMS\Support\IntelHCTAgent.exeC:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exeC:\PROGRA~1\CA\ETRUST~1ealmon.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Intel\IntelDH\CCU\AlertService.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exeC:\Program Files\CA\eTrust Antivirus\InoRpc.exeC:\Program Files\CA\eTrust Antivirus\InoRT.exeC:\Program Files\CA\eTrust Antivirus\InoTask.exeC:\WINDOWS\system32
vsvc32.exeC:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeC:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exeC:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exeC:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\CCleaner\ccleaner.exeC:\WINDOWS\system32svp.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXER0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portailR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [SkyTel] SkyTel.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exeO4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Fichiers communs\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startupO4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exeO4 - HKLM\..\Run: [Adobe] "C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe"O4 - HKLM\..\Run: [AntivirusRegistration] C:\Program Files\CA\Etrust Antivirus\Register.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1ealmon.exe -sO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_sit...O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_sit...O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO21 - SSODL: hemadynamometer - {6076d2b1-634c-4685-843b-f826045ea5dc} - C:\WINDOWS\system32\syycum.dll (file missing)O23 - Service: Intel(R) Alert Service (AlertService) - Intel Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exeO23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exeO23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exeO23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exeO23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exeO23 - Service: Intel(R) Software Services Manager (ISSM) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exeO23 - Service: Serveur Média Intel(R) Viiv(TM) (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exeO23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exeO23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Utilisateur anonyme · Answer

Salut,

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked"

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe] "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_sit...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_sit...
O21 - SSODL: hemadynamometer - {6076d2b1-634c-4685-843b-f826045ea5dc} - C:\WINDOWS\system32\syycum.dll (file missing)

Désactive le pare-feu de Windows car il ne sert à rien et installe celui-ci pour que tu sois mieux protégé

Kerio: (pare-feu, qui reste gratuit après la periode d'essai!)
Kerio Personal Firewall
-tutorial: pour configurer et comprendre l'utilisation de Kerio
https://kerio.probb.fr/

Alors ceci; C:\System Volume Information\_restore(voir rapport Bitdefender) indique que ta restauration du systeme etait infecté ou est infecté, pour être sûr, nous allons créer un point propre.

Clic sur "demarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du systeme"

¤ coches la case "desactiver la Restauration du systéme sur tous les lecteurs", puis clic ur "appliquer"
¤ decoches la case et clic sur "appliquer" puis "ok".

Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre:

Clic sur "demarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, cliques sur "créer" puis "ok".
Voilà, maintenant le point de restauration est créer si un jour tu décides tu pourra revenir en arriere à la date que tu l'as créer donc à ce jour; en fesant la marche arriére tu pourra remettre ton ordinateur à la date ou l'on à créer ce point de restauration mais tu perdra les modifications que tu aura faites entre deux.

anmalemax · Answer

ok , j'ai fait les differentes manips , quelle est la suite ?merci pour ton aide

anmalemax · Answer

salut j'ai nettoyé avec cc cleaner , mais je n'arrive pas à faire un scan online avec kaspersky. il me dirige vers une fenêtre connection d'acces à distance.?que faire ?merci à toi

Utilisateur anonyme · Answer

Salut,essaye d'en faire un présent sur cette listehttps://kerio.probb.fr/t11-scanner-votre-ordinateur-en-ligne-contre-les-virus

Utilisateur anonyme · Answer

Salut,oui, tu peux le supprimer, c'est une saloprie.Regarde dans C:,program files, si tu as ces dossiers si oui supprime les:digikeygenintcodecmedia-codecpcodec

anmalemax · Answer

OK et encore merci pour ton aide .

Utilisateur anonyme · Answer

derien ;-)où en est ton probléme ?

Virus W32.myzor.FK@yf

7 réponses

Votre réponse

Discussions similaires

Newsletters