[VIRUS] Multiples infections... Que faire?

Télécharges Avast antivirus,il est super clair,ou avast virus cleaner

bonjour,

je doute que ce soit avast qui lui supprimes toutes ses m....

* Télécharge VundoFix.exe (par Atribune) sur ton Bureau

http://www.atribune.org/ccount/click.php?id=4

* Double-clique VundoFix.exe afin de le lancer

* Clique sur le bouton Scan for Vundo

* Lorsque le scan est complété, clique sur le bouton Remove Vundo

* Une invite te demandera si tu veux supprimer les fichiers, clique YES

* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers

* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK

* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

Mais qu'est ce que vous avez contre Avast?C'est le meilleur antivirus gratuit

bonsoir,

rien du tout contre avast, néanmoins y a déjà un antivirus, donc pas la peine d'en rajouter un autre. Il sera tjs temps d'en changer ensuite pour le moment c'est nettoyer qu'il faut faire, et avast ne supprimera pas vundo, sinon....cela se saurait !

re

Oui,je connais Google et Vundo c'est un virus et un anti-virus,tu ne savais pas qu'Avast supprimait les adwares?Vundo en est un

pour la dernière fois, parce que franchement tu me fatigues. Si avast supprimait vundo, tout ceux qui ont avast ne serait pas infecté par vundo. Point barre
bonne nuit

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 10:53:00 04/04/2007

Listing files found while scanning....

C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\system32\agipsoal.dll
C:\WINDOWS\system32\bylafiiv.dll
C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.tmp

Beginning removal...

Attempting to delete C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\Program Files\VSAdd-in\VSAdd-in.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\dcwxjnmn.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\system32\feclmfjr.dll Could not be deleted.

Attempting to delete C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\System32\gebyy.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\hggibqpa.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\luleeorf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\urkikhpy.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\xerojupa.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\system32\yphkikru.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\System32\yybeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.tmp
C:\WINDOWS\system32\yybeg.tmp Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 12:18:44 04/04/2007

Listing files found while scanning....

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 21:14:33 04/04/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 21:11:41 14/04/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:31:15, on 14/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {532C4FBA-D9D1-4C4E-8478-A23463C1C3Ed} - C:\WINDOWS\system32\sattrxqr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O2 - BHO: (no name) - {BF5314D5-FF0A-4F05-9033-0AACEAB76C9A} - C:\WINDOWS\System32\gebyy.dll (file missing)
O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
O3 - Toolbar: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Microsft Security Monitor Process] cmh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\yphkikru.dll",setvm
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] cmh.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

bonsoir,

* Télécharge Pocket KillBox sur ton bureau.
http://www.downloads.subratam.org/KillBox.exe

puis

* Relance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :

C:\WINDOWS\system32\sattrxqr.dll
C:\WINDOWS\system32\yphkikru.dll

* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix

puis

* lance hijackthis pour un "scan seulement" puis coche ces lignes :

O2 - BHO: (no name) - {532C4FBA-D9D1-4C4E-8478-A23463C1C3Ed} - C:\WINDOWS\system32\sattrxqr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {BF5314D5-FF0A-4F05-9033-0AACEAB76C9A} - C:\WINDOWS\System32\gebyy.dll (file missing)
O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
O3 - Toolbar: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O4 - HKLM\..\Run: [Microsft Security Monitor Process] cmh.exe
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\yphkikru.dll",setvm
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] cmh.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

* ferme toutes les applications ouvertes y compris Internet Explorer et clique sur "fixer objet"

1- Double-clic sur KillBox.exe
2- Selectionne "Delete on Reboot"
3 - Dans "Full Path of File to Delete"
copie et colle:

c:\windows\system32\cmh.exe

5- clic sur le rond rouge
6- une fenetre va apparaitre pour confirmation clic sur OUI
7- une seconde fenetre te demande si tu veux redemarrer clic sur OUI

* fait une recherche avec windows pour supprimer ceci :

NULL

reposte un nouveau rapport hijackthis stp ainsi que celui de vundo

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 10:53:00 04/04/2007

Listing files found while scanning....

C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\system32\agipsoal.dll
C:\WINDOWS\system32\bylafiiv.dll
C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.tmp

Beginning removal...

Attempting to delete C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\Program Files\VSAdd-in\VSAdd-in.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\dcwxjnmn.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\system32\feclmfjr.dll Could not be deleted.

Attempting to delete C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\System32\gebyy.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\hggibqpa.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\luleeorf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\urkikhpy.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\xerojupa.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\system32\yphkikru.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\System32\yybeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yybeg.tmp
C:\WINDOWS\system32\yybeg.tmp Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 12:18:44 04/04/2007

Listing files found while scanning....

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 21:14:33 04/04/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

VundoFix V6.3.19

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 21:11:41 14/04/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

Beginning removal...

Attempting to delete C:\WINDOWS\system32\sattrxqr.dll
C:\WINDOWS\system32\sattrxqr.dll Has been deleted!

Performing Repairs to the registry.
Done!

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 06:13:16, on 15/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\Nicolas\Bureau\VundoFix.exe
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

bonjour,

pas mal, ton pc devrait mieux respirer maintenant non ?

* Fait un scan antivirus en ligne
https://www.bitdefender.fr/
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
* Dans la nouvelle fenêtre, clique sur I agree
* La fenêtre change encore, clique sur Click here to scan
* Les signatures se chargent, etc.

tuto en image

http://pageperso.aol.fr/rginformatique/mapage/defender.htm

Rapport d'analyse généré à: Sun, Apr 15, 2007 - 16:08:59

Voie d'analyse: A:\;C:\;D:\;E:\;

Statistiques

Temps

02:42:22

Fichiers

487267

Directoires

7507

Secteurs de boot

2

Archives

3879

Paquets programmes

35100

Résultats

Virus identifiés

8

Fichiers infectés

20

Fichiers suspects

0

Avertissements

0

Désinfectés

0

Fichiers effacés

20

Info sur les moteurs

Définition virus

486039

Version des moteurs

AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)

Analyse des plugins

14

Archive des plugins

38

Unpack des plugins

6

E-mail plugins

6

Système plugins

1

Paramètres d'analyse

Première action

Désinfecté

Seconde Action

Supprimé

Heuristique

Oui

Acceptez les avertissements

Oui

Extensions analysées

*;

Excludez les extensions

Analyse d'emails

Oui

Analyse des Archives

Oui

Analyser paquets programmes

Oui

Analyse des fichiers

Oui

Analyse de boot

Oui

Fichier analysé

Statut

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class

Infecté par: Java.Trojan.Exploit.Bytverify

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class

Echec de la désinfection

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class

Supprimé

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip

Mis à jour

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class

Infecté par: Java.Trojan.Exploit.Bytverify.C

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class

Echec de la désinfection

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class

Supprimé

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip

Mis à jour

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class

Infecté par: Java.Trojan.Exploit.Bytverify

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class

Echec de la désinfection

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class

Supprimé

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip

Mis à jour

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class

Infecté par: Java.Trojan.Exploit.Bytverify.C

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class

Echec de la désinfection

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class

Supprimé

C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip

Mis à jour

C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe

Infecté par: Trojan.Bat.Hdkill.A

C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe

Echec de la désinfection

C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe

Supprimé

C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar

Echec de la mise à jour

C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe

Infecté par: Trojan.Bat.Hdkill.A

C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe

Echec de la désinfection

C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe

Supprimé

C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar

Echec de la mise à jour

C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll

Infecté par: Trojan.BHO.AR

C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll

Echec de la désinfection

C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll

Supprimé

C:\VundoFix Backups\luleeorf.dll.bad

Infecté par: Trojan.BHO.G

C:\VundoFix Backups\luleeorf.dll.bad

Echec de la désinfection

C:\VundoFix Backups\luleeorf.dll.bad

Supprimé

C:\VundoFix Backups\sattrxqr.dll.bad

Infecté par: Trojan.BHO.AR

C:\VundoFix Backups\sattrxqr.dll.bad

Echec de la désinfection

C:\VundoFix Backups\sattrxqr.dll.bad

Supprimé

C:\VundoFix Backups\yphkikru.dll.bad

Infecté par: Trojan.Virtumod.JB

C:\VundoFix Backups\yphkikru.dll.bad

Echec de la désinfection

C:\VundoFix Backups\yphkikru.dll.bad

Supprimé

C:\WINDOWS\system32\eynehkxm.dll

Infecté par: Trojan.BHO.AR

C:\WINDOWS\system32\eynehkxm.dll

Echec de la désinfection

C:\WINDOWS\system32\eynehkxm.dll

Supprimé

C:\WINDOWS\system32\hbaapplg.dll

Infecté par: Trojan.BHO.AR

C:\WINDOWS\system32\hbaapplg.dll

Echec de la désinfection

C:\WINDOWS\system32\hbaapplg.dll

Supprimé

C:\WINDOWS\system32\jklhglcd.dll

Infecté par: Trojan.BHO.AR

C:\WINDOWS\system32\jklhglcd.dll

Echec de la désinfection

C:\WINDOWS\system32\jklhglcd.dll

Supprimé

C:\WINDOWS\system32\mbfxpfrl.dll

Infecté par: Trojan.BHO.AL

C:\WINDOWS\system32\mbfxpfrl.dll

Echec de la désinfection

C:\WINDOWS\system32\mbfxpfrl.dll

Supprimé

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002

Détecté avec: Adware.Softomate.D

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002

Echec de la désinfection

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002

Supprimé

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)

Echec de la mise à jour

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006

Détecté avec: Adware.Softomate.D

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006

Echec de la désinfection

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006

Supprimé

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)

Echec de la mise à jour

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002

Détecté avec: Adware.Softomate.D

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002

Echec de la désinfection

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002

Supprimé

C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)

Echec de la mise à jour

C:\WINDOWS\system32\sccbeqet.dll

Infecté par: Trojan.BHO.AR

C:\WINDOWS\system32\sccbeqet.dll

Echec de la désinfection

C:\WINDOWS\system32\sccbeqet.dll

Supprimé

C:\WINDOWS\system32\ttoobyyv.dll

Infecté par: Trojan.BHO.AR

C:\WINDOWS\system32\ttoobyyv.dll

Echec de la désinfection

C:\WINDOWS\system32\ttoobyyv.dll

Supprimé

C:\WINDOWS\system32\ylvsiyqq.dll

Infecté par: Trojan.BHO.AL

C:\WINDOWS\system32\ylvsiyqq.dll

Echec de la désinfection

C:\WINDOWS\system32\ylvsiyqq.dll

Supprimé

re

visiblement il a terminé le ménage. Encore des problèmes ?

mais les téléchargements.....

The Sims 2 University 

pas bon !!!

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:40:30, on 15/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

re

ok, encore des soucis ou non ?

Je ne sais pas, pour le moment non :)
Je pensais qu'un rapport vous suffisez à me dire s'il me reste des merdes ^^
MErci infiniment!

re
non on ne voit pas tout dans un rapport Hijackthis, ceci dit, je pense que si tu n'as plus de problème apparents après tout le ménage qu'on a fait, ce devrait être bon

* Tu peux supprimer tous les logiciels que nous avons utilisés
qui traitent des infections spécifiques et qui sont mis à jour réguliérement.

* démarrer-----------panneau de configuration------------système----------
onglet Restauration système-----------coche la case (Désactiver la restauration système)--------------
redémarre l'ordinateur
réactive la ensuite

* Pour améliorer la sécurité de ton PC prend quelques instants pour lire

CECI

* Dénonce ton infection pour faire condamner les auteurs.
Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :

- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"

Tu as alors sous forme de liste un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).
La tienne = ******

---> https://malwarecomplaints.info/

Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections
conforme au règle du forum (age, ville, département etc..)

Indique aussi le nom du Forum qui t'a aidé, <grad>CommentCaMarche</gras>

* met ton sujet en RESOLU stp, merci.