[Spam indésirable] fenêtre WinAntispyware2006
Résolu/Fermé
Gawetss
Messages postés
11
Date d'inscription
jeudi 21 décembre 2006
Statut
Membre
Dernière intervention
10 juillet 2007
-
22 déc. 2006 à 22:48
<script> alert 'hello' </script> - 13 oct. 2007 à 12:53
<script> alert 'hello' </script> - 13 oct. 2007 à 12:53
A voir également:
- Spam.exe
- Spam sur téléphone mobile - Accueil - Protection
- Fenêtre hors écran windows 11 - Guide
- Liste numéro indésirable - Guide
- Raccourci agrandir fenetre - Guide
- Fenêtre - Guide
23 réponses
bonsoir greeny,
'ai suivi instruion et voila le raportde VBG.TXT:
[10/14/2007, 0:14:37] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" )
[10/14/2007, 0:14:47] - Detected System Information:
[10/14/2007, 0:14:47] - Windows Version: 5.1.2600, Service Pack 2
[10/14/2007, 0:14:47] - Current Username: Administrateur (Admin)
[10/14/2007, 0:14:48] - Windows is in NORMAL mode.
[10/14/2007, 0:14:48] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:48] - Found: HKLM\...\Winlogon\Notify\awtsssp - This is probably Virtumundo.
[10/14/2007, 0:14:48] - Assigning {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} MSEvents Object
[10/14/2007, 0:14:48] - BHO list has been changed! Starting over...
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} (MSEvents Object)
[10/14/2007, 0:14:48] - ALERT: Found MSEvents Object!
[10/14/2007, 0:14:48] - BHO 4: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:48] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:48] - BHO 6: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:48] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:48] - BHO 8: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - No filename found. Continuing.
[10/14/2007, 0:14:48] - BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:48] - BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:48] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:48] - *** Detected MSEvents Object
[10/14/2007, 0:14:48] - Trying to remove MSEvents Object...
[10/14/2007, 0:14:49] - Terminating Process: IEXPLORE.EXE
[10/14/2007, 0:14:50] - Terminating Process: RUNDLL32.EXE
[10/14/2007, 0:14:50] - Disabling Automatic Shell Restart
[10/14/2007, 0:14:51] - Terminating Process: EXPLORER.EXE
[10/14/2007, 0:14:51] - Suspending the NT Session Manager System Service
[10/14/2007, 0:14:51] - Terminating Windows NT Logon/Logoff Manager
[10/14/2007, 0:14:52] - Re-enabling Automatic Shell Restart
[10/14/2007, 0:14:52] - File to disable: C:\WINDOWS\system32\awtsssp.dll
[10/14/2007, 0:14:52] - Renaming C:\WINDOWS\system32\awtsssp.dll -> C:\WINDOWS\system32\awtsssp.dll.vir
[10/14/2007, 0:14:52] - File successfully renamed!
[10/14/2007, 0:14:52] - Removing HKLM\...\Browser Helper Objects\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Removing HKCR\CLSID\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Adding Kill Bit for ActiveX for GUID: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Deleting ATLEvents/MSEvents Registry entries
[10/14/2007, 0:14:52] - Removing HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:52] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:52] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:52] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:52] - BHO 3: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:52] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:52] - BHO 5: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:52] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:52] - BHO 7: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:53] - No filename found. Continuing.
[10/14/2007, 0:14:53] - BHO 8: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:53] - BHO 9: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:53] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:53] - Finishing up...
[10/14/2007, 0:14:53] - A restart is needed.
[10/14/2007, 0:14:53] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[10/14/2007, 0:15:11] - Attempting to Restart via STOP error (Blue Screen!)
et apré qusque fais.
'ai suivi instruion et voila le raportde VBG.TXT:
[10/14/2007, 0:14:37] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" )
[10/14/2007, 0:14:47] - Detected System Information:
[10/14/2007, 0:14:47] - Windows Version: 5.1.2600, Service Pack 2
[10/14/2007, 0:14:47] - Current Username: Administrateur (Admin)
[10/14/2007, 0:14:48] - Windows is in NORMAL mode.
[10/14/2007, 0:14:48] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:48] - Found: HKLM\...\Winlogon\Notify\awtsssp - This is probably Virtumundo.
[10/14/2007, 0:14:48] - Assigning {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} MSEvents Object
[10/14/2007, 0:14:48] - BHO list has been changed! Starting over...
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} (MSEvents Object)
[10/14/2007, 0:14:48] - ALERT: Found MSEvents Object!
[10/14/2007, 0:14:48] - BHO 4: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:48] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:48] - BHO 6: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:48] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:48] - BHO 8: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - No filename found. Continuing.
[10/14/2007, 0:14:48] - BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:48] - BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:48] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:48] - *** Detected MSEvents Object
[10/14/2007, 0:14:48] - Trying to remove MSEvents Object...
[10/14/2007, 0:14:49] - Terminating Process: IEXPLORE.EXE
[10/14/2007, 0:14:50] - Terminating Process: RUNDLL32.EXE
[10/14/2007, 0:14:50] - Disabling Automatic Shell Restart
[10/14/2007, 0:14:51] - Terminating Process: EXPLORER.EXE
[10/14/2007, 0:14:51] - Suspending the NT Session Manager System Service
[10/14/2007, 0:14:51] - Terminating Windows NT Logon/Logoff Manager
[10/14/2007, 0:14:52] - Re-enabling Automatic Shell Restart
[10/14/2007, 0:14:52] - File to disable: C:\WINDOWS\system32\awtsssp.dll
[10/14/2007, 0:14:52] - Renaming C:\WINDOWS\system32\awtsssp.dll -> C:\WINDOWS\system32\awtsssp.dll.vir
[10/14/2007, 0:14:52] - File successfully renamed!
[10/14/2007, 0:14:52] - Removing HKLM\...\Browser Helper Objects\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Removing HKCR\CLSID\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Adding Kill Bit for ActiveX for GUID: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Deleting ATLEvents/MSEvents Registry entries
[10/14/2007, 0:14:52] - Removing HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:52] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:52] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:52] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:52] - BHO 3: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:52] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:52] - BHO 5: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:52] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:52] - BHO 7: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:53] - No filename found. Continuing.
[10/14/2007, 0:14:53] - BHO 8: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:53] - BHO 9: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:53] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:53] - Finishing up...
[10/14/2007, 0:14:53] - A restart is needed.
[10/14/2007, 0:14:53] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[10/14/2007, 0:15:11] - Attempting to Restart via STOP error (Blue Screen!)
et apré qusque fais.
green day
Messages postés
26371
Date d'inscription
vendredi 30 septembre 2005
Statut
Modérateur, Contributeur sécurité
Dernière intervention
27 décembre 2019
2 162
13 oct. 2007 à 12:51
13 oct. 2007 à 12:51
Salut
ok, poste un nouveau rapport avec vundo fais en mode sans echec puis un nouveau hijack en mode normal stp
++
ok, poste un nouveau rapport avec vundo fais en mode sans echec puis un nouveau hijack en mode normal stp
++