[Spam indésirable] fenêtre WinAntispyware2006 - Page 2

Résolu
Précédent
  • 1
  • 2
Réponse 21 / 23
volcano88
 
bonsoir greeny,
'ai suivi instruion et voila le raportde VBG.TXT:

[10/14/2007, 0:14:37] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" )
[10/14/2007, 0:14:47] - Detected System Information:
[10/14/2007, 0:14:47] - Windows Version: 5.1.2600, Service Pack 2
[10/14/2007, 0:14:47] - Current Username: Administrateur (Admin)
[10/14/2007, 0:14:48] - Windows is in NORMAL mode.
[10/14/2007, 0:14:48] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:48] - Found: HKLM\...\Winlogon\Notify\awtsssp - This is probably Virtumundo.
[10/14/2007, 0:14:48] - Assigning {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} MSEvents Object
[10/14/2007, 0:14:48] - BHO list has been changed! Starting over...
[10/14/2007, 0:14:48] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:48] - BHO 3: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4} (MSEvents Object)
[10/14/2007, 0:14:48] - ALERT: Found MSEvents Object!
[10/14/2007, 0:14:48] - BHO 4: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:48] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:48] - BHO 6: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:48] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:48] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:48] - BHO 8: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:48] - No filename found. Continuing.
[10/14/2007, 0:14:48] - BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:48] - BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:48] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:48] - *** Detected MSEvents Object
[10/14/2007, 0:14:48] - Trying to remove MSEvents Object...
[10/14/2007, 0:14:49] - Terminating Process: IEXPLORE.EXE
[10/14/2007, 0:14:50] - Terminating Process: RUNDLL32.EXE
[10/14/2007, 0:14:50] - Disabling Automatic Shell Restart
[10/14/2007, 0:14:51] - Terminating Process: EXPLORER.EXE
[10/14/2007, 0:14:51] - Suspending the NT Session Manager System Service
[10/14/2007, 0:14:51] - Terminating Windows NT Logon/Logoff Manager
[10/14/2007, 0:14:52] - Re-enabling Automatic Shell Restart
[10/14/2007, 0:14:52] - File to disable: C:\WINDOWS\system32\awtsssp.dll
[10/14/2007, 0:14:52] - Renaming C:\WINDOWS\system32\awtsssp.dll -> C:\WINDOWS\system32\awtsssp.dll.vir
[10/14/2007, 0:14:52] - File successfully renamed!
[10/14/2007, 0:14:52] - Removing HKLM\...\Browser Helper Objects\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Removing HKCR\CLSID\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Adding Kill Bit for ActiveX for GUID: {4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}
[10/14/2007, 0:14:52] - Deleting ATLEvents/MSEvents Registry entries
[10/14/2007, 0:14:52] - Removing HKLM\...\Winlogon\Notify\awtsssp
[10/14/2007, 0:14:52] - Searching for Browser Helper Objects:
[10/14/2007, 0:14:52] - BHO 1: {0055C089-8582-441B-A0BF-17B458C2A3A8} (IDMIEHlprObj Class)
[10/14/2007, 0:14:52] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/14/2007, 0:14:52] - BHO 3: {51416294-95B1-4750-8F9E-9A4845E6C676} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\vtstt
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\vtstt, continuing.
[10/14/2007, 0:14:52] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/14/2007, 0:14:52] - BHO 5: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/14/2007, 0:14:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:52] - Checking for HKLM\...\Winlogon\Notify\rvbamwxd
[10/14/2007, 0:14:52] - Key not found: HKLM\...\Winlogon\Notify\rvbamwxd, continuing.
[10/14/2007, 0:14:52] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/14/2007, 0:14:52] - BHO 7: {91521DFF-A8B7-4541-8BCD-8456E6DC44D5} ()
[10/14/2007, 0:14:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/14/2007, 0:14:53] - No filename found. Continuing.
[10/14/2007, 0:14:53] - BHO 8: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/14/2007, 0:14:53] - BHO 9: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/14/2007, 0:14:53] - Finished Searching Browser Helper Objects
[10/14/2007, 0:14:53] - Finishing up...
[10/14/2007, 0:14:53] - A restart is needed.
[10/14/2007, 0:14:53] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[10/14/2007, 0:15:11] - Attempting to Restart via STOP error (Blue Screen!)

et apré qusque fais.
0
Réponse 22 / 23
green day Messages postés 26319 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
 
Salut

ok, poste un nouveau rapport avec vundo fais en mode sans echec puis un nouveau hijack en mode normal stp

++
0
Réponse 23 / 23
<script> alert 'hello' </script>
 
<script> alert 'hello' </script>
0
Précédent
  • 1
  • 2

Discussions similaires

Spam proximeety
Fkeiene -
momo -

1 réponse
Compte WhatsApp bloqué pour cause de spam que faire ?
John -
bazfile -

11 réponses