[Virus] Infecté par Win32:Trojan-Gen Fermé

Question

Bonsoir,

je suis infecté par ce virus et malgré toutes les recommandations et les différentes manières trouvées pour le supprimer, je n'y arrive pas.

Je suis sous WIN XP Pro, avec Avast!

Merci d'avance pour votre aide,

Cordialement,

Jérôme

PS : Je rajoute que mon repertoire c:\windows	emp\ est plein de fichiers win****.tmp, de plus les fichiers trouvés par Avast! sont des exe qui se trouve dans local settings\IE\Temp.....

Grymander · Answer

Rebonsoir,
Pour prendre un peu d'avance je vous joint le 1er rapport Hijackthis, puis le rapport après Vundo et enfin le rapport Hijackthis final...

Logfile of HijackThis v1.99.1
Scan saved at 22:18:06, on 04/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Foxmail\Foxmail.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\system32\udial.exe
C:\WINDOWS\system32\udial.exe
C:\WINDOWS\system32\udial.exe
C:\WINDOWS\system32\udial.exe
C:\WINDOWS\system32\udial.exe
C:\WINDOWS\system32\udial.exe
C:\hijack\scan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A7EAC85-D474-EEE9-6CC6-0816F332E111} - C:\WINDOWS\system32	oxxhc.dll
O2 - BHO: (no name) - {2EAFAB18-4F81-4A3E-AB26-F079F93B5F3E} - C:\WINDOWS\system32\geebx.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9FF92BD1-ABE4-4879-9D06-C0983FD27A3D} - (no file)
O2 - BHO: (no name) - {C84400A8-82F7-42C3-87F4-D1D67FE959D1} - C:\WINDOWS\system32\gebbawt.dll
O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - C:\WINDOWS\system32xytrhdp.dll
O2 - BHO: (no name) - {E0210C4D-DD73-4814-B749-50E1C7E9E049} - C:\WINDOWS\system32\geebx.dll
O3 - Toolbar: (no name) - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geomapguide.com/aixenprovence/Cabs/mgaxctrl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: gebbawt - C:\WINDOWS\SYSTEM32\gebbawt.dll
O20 - Winlogon Notify: geebx - C:\WINDOWS\system32\geebx.dll
O20 - Winlogon Notify: winmmt32 - C:\WINDOWS\SYSTEM32\winmmt32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Grymander · Answer

Re,

voici le rapport Vundo et l'autre Hijack


VundoFix V6.3.2

Checking Java version...

Sun Java not detected
Scan started at 00:52:34 23/01/2007

Listing files found while scanning....


VundoFix V6.3.2

Checking Java version...

Sun Java not detected
Scan started at 12:13:08 23/01/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\fcccccc.dll
C:\WINDOWS\system32\gebcb.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fcccccc.dll
C:\WINDOWS\system32\fcccccc.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\fcccccc.dll
C:\WINDOWS\system32\fcccccc.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.2

Checking Java version...

Sun Java not detected
Scan started at 12:11:53 24/01/2007

Listing files found while scanning....

C:\WINDOWS\system32\iifecay.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\iifecay.dll
C:\WINDOWS\system32\iifecay.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.2

Checking Java version...

Sun Java not detected
Scan started at 09:34:44 27/01/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.3.2

Checking Java version...

Sun Java not detected
Scan started at 10:47:48 27/01/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.3.12

Checking Java version...

Java version is 1.5.0.10

Scan started at 22:34:36 04/03/2007

Listing files found while scanning....

C:\WINDOWS\system32\asvnyopy.exe
C:\WINDOWS\system32\atvxpstw.exe
C:\WINDOWS\system32\bbjiocaq.dll
C:\WINDOWS\system32\bbkdakhv.exe
C:\WINDOWS\system32\bjnwfdlq.exe
C:\WINDOWS\system32\ceqkkvak.exe
C:\WINDOWS\system32\ehadakxr.dll
C:\WINDOWS\system32\fdtudtgo.exe
C:\WINDOWS\system32\gebbawt.dll
C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\hjiwyirs.dll
C:\WINDOWS\system32\hmrfcwyf.exe
C:\WINDOWS\system32\isxdtlub.exe
C:\WINDOWS\system32\jxnhlgje.exe
C:\WINDOWS\system32\kcpysgwb.dll
C:\WINDOWS\system32\lirikjgn.exe
C:\WINDOWS\system32\ltinbtbc.dll
C:\WINDOWS\system32\mpiyjnay.exe
C:\WINDOWS\system32
rlbdpdt.exe
C:\WINDOWS\system32\obexsyul.dll
C:\WINDOWS\system32\ohclkaog.exe
C:\WINDOWS\system32\ojdkxjbc.exe
C:\WINDOWS\system32\onthejea.dll
C:\WINDOWS\system32\oqfepdis.exe
C:\WINDOWS\system32\pgkhqlcj.dll
C:\WINDOWS\system32\pgqksdvv.exe
C:\WINDOWS\system32\psernebb.dll
C:\WINDOWS\system32\qeuvungu.exe
C:\WINDOWS\system32\qkaxodpa.exe
C:\WINDOWS\system32xytrhdp.dll
C:\WINDOWS\system32	psvcuxy.dll
C:\WINDOWS\system32\ujoqcnvq.dll
C:\WINDOWS\system32\utuusudl.exe
C:\WINDOWS\system32\winmmt32.dll
C:\WINDOWS\system32\xbeeg.bak1
C:\WINDOWS\system32\xbeeg.bak2
C:\WINDOWS\system32\xbeeg.ini
C:\WINDOWS\system32\xbeeg.ini2
C:\WINDOWS\system32\xbeeg.tmp
C:\WINDOWS\system32\xnklwwgs.dll
C:\WINDOWS\system32\ycwiaghd.dll
C:\WINDOWS\system32\ykvywduj.exe

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\asvnyopy.exe
C:\WINDOWS\system32\asvnyopy.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\atvxpstw.exe
C:\WINDOWS\system32\atvxpstw.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\bbjiocaq.dll
C:\WINDOWS\system32\bbjiocaq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\bbkdakhv.exe
C:\WINDOWS\system32\bbkdakhv.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\bjnwfdlq.exe
C:\WINDOWS\system32\bjnwfdlq.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ceqkkvak.exe
C:\WINDOWS\system32\ceqkkvak.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ehadakxr.dll
C:\WINDOWS\system32\ehadakxr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fdtudtgo.exe
C:\WINDOWS\system32\fdtudtgo.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gebbawt.dll
C:\WINDOWS\system32\gebbawt.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\geebx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hjiwyirs.dll
C:\WINDOWS\system32\hjiwyirs.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hmrfcwyf.exe
C:\WINDOWS\system32\hmrfcwyf.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\isxdtlub.exe
C:\WINDOWS\system32\isxdtlub.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jxnhlgje.exe
C:\WINDOWS\system32\jxnhlgje.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\kcpysgwb.dll
C:\WINDOWS\system32\kcpysgwb.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\lirikjgn.exe
C:\WINDOWS\system32\lirikjgn.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ltinbtbc.dll
C:\WINDOWS\system32\ltinbtbc.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\mpiyjnay.exe
C:\WINDOWS\system32\mpiyjnay.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32
rlbdpdt.exe
C:\WINDOWS\system32
rlbdpdt.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\obexsyul.dll
C:\WINDOWS\system32\obexsyul.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ohclkaog.exe
C:\WINDOWS\system32\ohclkaog.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ojdkxjbc.exe
C:\WINDOWS\system32\ojdkxjbc.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\onthejea.dll
C:\WINDOWS\system32\onthejea.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\oqfepdis.exe
C:\WINDOWS\system32\oqfepdis.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pgqksdvv.exe
C:\WINDOWS\system32\pgqksdvv.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qeuvungu.exe
C:\WINDOWS\system32\qeuvungu.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qkaxodpa.exe
C:\WINDOWS\system32\qkaxodpa.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32xytrhdp.dll
C:\WINDOWS\system32xytrhdp.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	psvcuxy.dll
C:\WINDOWS\system32	psvcuxy.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ujoqcnvq.dll
C:\WINDOWS\system32\ujoqcnvq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\utuusudl.exe
C:\WINDOWS\system32\utuusudl.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\winmmt32.dll
C:\WINDOWS\system32\winmmt32.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xbeeg.bak1
C:\WINDOWS\system32\xbeeg.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xbeeg.bak2
C:\WINDOWS\system32\xbeeg.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xbeeg.ini
C:\WINDOWS\system32\xbeeg.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xbeeg.ini2
C:\WINDOWS\system32\xbeeg.ini2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xbeeg.tmp
C:\WINDOWS\system32\xbeeg.tmp Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xnklwwgs.dll
C:\WINDOWS\system32\xnklwwgs.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ycwiaghd.dll
C:\WINDOWS\system32\ycwiaghd.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ykvywduj.exe
C:\WINDOWS\system32\ykvywduj.exe Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\gebbawt.dll
C:\WINDOWS\system32\gebbawt.dll Has been deleted!

Performing Repairs to the registry.
Done!

____________________
RAPPORT HIJACKTHIS
_____________________
Logfile of HijackThis v1.99.1
Scan saved at 22:52:09, on 04/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\system32\udial.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hijack\scan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A7EAC85-D474-EEE9-6CC6-0816F332E111} - C:\WINDOWS\system32	oxxhc.dll
O2 - BHO: (no name) - {2EAFAB18-4F81-4A3E-AB26-F079F93B5F3E} - C:\WINDOWS\system32\geebx.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9FF92BD1-ABE4-4879-9D06-C0983FD27A3D} - (no file)
O2 - BHO: (no name) - {C84400A8-82F7-42C3-87F4-D1D67FE959D1} - C:\WINDOWS\system32\gebbawt.dll (file missing)
O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - C:\WINDOWS\system32xytrhdp.dll (file missing)
O2 - BHO: (no name) - {E0210C4D-DD73-4814-B749-50E1C7E9E049} - C:\WINDOWS\system32\geebx.dll (file missing)
O3 - Toolbar: (no name) - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [UDial] C:\WINDOWS\system32/udial.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geomapguide.com/aixenprovence/Cabs/mgaxctrl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Utilisateur anonyme · Answer

Salut

Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu.. 

Puis recommence un scan avec Vundo et colle le rapport ici stp

[Virus] Infecté par Win32:Trojan-Gen

3 réponses

Discussions similaires