[Spam indésirable] fenêtre WinAntispyware2006 - Page 2

bonsoir greeny,
'ai suivi instruion et voila le raportde VBG.TXT:

[10/14/2007, 0:14:37] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" )
[10/14/2007, 0:14:47] - Detected System Information:
[10/14/2007, 0:14:47] - Windows Version: 5.1.2600, Service Pack 2
[10/14/2007, 0:14:47] - Current Username: Administrateur (Admin)
[10/14/2007, 0:14:48] - Windows is in NORMAL mode.
[10/14/2007, 0:14:48] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:48] - Found: HKLM\...\Winlogon\Notify\awtsssp - This is probably Virtumundo.
[10/14/2007, 0:14:48] - Assigning {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} MSEvents Object
[10/14/2007, 0:14:48] - BHO list has been changed! Starting over...
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} (MSEvents Object)
[10/14/2007, 0:14:48] - ALERT: Found MSEvents Object!
[10/14/2007, 0:14:48] - BHO 4: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:48] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:48] - BHO 6: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:48] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:48] - BHO 8: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - No filename found. Continuing.
[10/14/2007, 0:14:48] - BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:48] - BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:48] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:48] - *** Detected MSEvents Object
[10/14/2007, 0:14:48] - Trying to remove MSEvents Object...
[10/14/2007, 0:14:49] - Terminating Process: IEXPLORE.EXE
[10/14/2007, 0:14:50] - Terminating Process: RUNDLL32.EXE
[10/14/2007, 0:14:50] - Disabling Automatic Shell Restart
[10/14/2007, 0:14:51] - Terminating Process: EXPLORER.EXE
[10/14/2007, 0:14:51] - Suspending the NT Session Manager System Service
[10/14/2007, 0:14:51] - Terminating Windows NT Logon/Logoff Manager
[10/14/2007, 0:14:52] - Re-enabling Automatic Shell Restart
[10/14/2007, 0:14:52] - File to disable: C:\WINDOWS\system32\awtsssp.dll
[10/14/2007, 0:14:52] - Renaming C:\WINDOWS\system32\awtsssp.dll -> C:\WINDOWS\system32\awtsssp.dll.vir
[10/14/2007, 0:14:52] - File successfully renamed!
[10/14/2007, 0:14:52] - Removing HKLM\...\Browser Helper Objects\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Removing HKCR\CLSID\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Adding Kill Bit for ActiveX for GUID: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Deleting ATLEvents/MSEvents Registry entries
[10/14/2007, 0:14:52] - Removing HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:52] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:52] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:52] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:52] - BHO 3: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:52] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:52] - BHO 5: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:52] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:52] - BHO 7: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:53] - No filename found. Continuing.
[10/14/2007, 0:14:53] - BHO 8: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:53] - BHO 9: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:53] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:53] - Finishing up...
[10/14/2007, 0:14:53] - A restart is needed.
[10/14/2007, 0:14:53] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[10/14/2007, 0:15:11] - Attempting to Restart via STOP error (Blue Screen!)

et apré qusque fais.

Salut

ok, poste un nouveau rapport avec vundo fais en mode sans echec puis un nouveau hijack en mode normal stp

++

<script> alert 'hello' </script>