[Spyware] PC Infecté par Adware.Virtumonde

Bonjour

Télécharge VundoFix
---> http://www.atribune.org/ccount/click.php?id=4

Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu..

double clic dessus choisis "start for vundo"
attends quelques minutes, quand le scan est terminé clic sur "remove vundo"
un message te demandera si tu veux supprimes les fichiers sur "yes"
Quand il a terminé, clic sur "yes" ton ordinateur devrait redemarrer si non, fais le par toi même
Une fois qu'il a redémarré colle le rapport C:\vundofix.txt et un nouveau rapport hijackthis stp

Bonjour et merci de ton aide. DEsoler du retard, boulot oblige.

Voila mon rapport Vundofix

VundoFix V6.5.0

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 19:54:19 10/06/2007

Listing files found while scanning....

D:\WINDOWS\system32\ddcbbyy.dll
D:\WINDOWS\system32\ecaxtpnj.dll
D:\WINDOWS\system32\emcsyeux.dll
D:\windows\system32\hiuwroqp.dll
D:\windows\system32\laplgvqm.exe
D:\windows\system32\mvaqamjl.dll
D:\WINDOWS\system32\oqsru.bak1
D:\WINDOWS\system32\oqsru.bak2
D:\WINDOWS\system32\oqsru.ini
D:\WINDOWS\system32\oqsru.ini2
D:\windows\system32\pqorwuih.ini
D:\windows\system32\twbhovcu.exe
D:\WINDOWS\system32\ursqo.dll
D:\WINDOWS\system32\xueyscme.ini
D:\WINDOWS\system32\yugcmied.dll

Beginning removal...

Attempting to delete D:\WINDOWS\system32\ecaxtpnj.dll
D:\WINDOWS\system32\ecaxtpnj.dll Has been deleted!

Attempting to delete D:\WINDOWS\system32\emcsyeux.dll
D:\WINDOWS\system32\emcsyeux.dll Has been deleted!

Attempting to delete D:\windows\system32\hiuwroqp.dll
D:\windows\system32\hiuwroqp.dll Has been deleted!

Attempting to delete D:\windows\system32\laplgvqm.exe
D:\windows\system32\laplgvqm.exe Has been deleted!

Attempting to delete D:\windows\system32\mvaqamjl.dll
D:\windows\system32\mvaqamjl.dll Has been deleted!

Attempting to delete D:\WINDOWS\system32\oqsru.bak1
D:\WINDOWS\system32\oqsru.bak1 Has been deleted!

Attempting to delete D:\WINDOWS\system32\oqsru.bak2
D:\WINDOWS\system32\oqsru.bak2 Has been deleted!

Attempting to delete D:\WINDOWS\system32\oqsru.ini
D:\WINDOWS\system32\oqsru.ini Has been deleted!

Attempting to delete D:\WINDOWS\system32\oqsru.ini2
D:\WINDOWS\system32\oqsru.ini2 Has been deleted!

Attempting to delete D:\windows\system32\pqorwuih.ini
D:\windows\system32\pqorwuih.ini Has been deleted!

Attempting to delete D:\windows\system32\twbhovcu.exe
D:\windows\system32\twbhovcu.exe Has been deleted!

Attempting to delete D:\WINDOWS\system32\ursqo.dll
D:\WINDOWS\system32\ursqo.dll Could not be deleted.

Attempting to delete D:\WINDOWS\system32\xueyscme.ini
D:\WINDOWS\system32\xueyscme.ini Has been deleted!

Attempting to delete D:\WINDOWS\system32\yugcmied.dll
D:\WINDOWS\system32\yugcmied.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.0

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 20:25:29 10/06/2007

Listing files found while scanning....

D:\windows\system32\oqsru.ini
D:\WINDOWS\system32\ursqo.dll

Beginning removal...

Attempting to delete D:\windows\system32\oqsru.ini
D:\windows\system32\oqsru.ini Has been deleted!

Attempting to delete D:\WINDOWS\system32\ursqo.dll
D:\WINDOWS\system32\ursqo.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete D:\windows\system32\oqsru.ini
D:\windows\system32\oqsru.ini Has been deleted!

Attempting to delete D:\WINDOWS\system32\ursqo.dll
D:\WINDOWS\system32\ursqo.dll Has been deleted!

Performing Repairs to the registry.
Done!

Et ensuite mon rapport Hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 20:47:25, on 10/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
D:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
D:\Program Files\ONSPEED\onspeedcore.exe
D:\Program Files\Picasa2\PicasaMediaDetector.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
D:\Program Files\Giganology\Gigaget\GigagetShell.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: GigagetIEHelper - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - D:\WINDOWS\system32\gigagetbho_v10.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Program Files\FlashGet\jccatch.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - D:\Program Files\ONSPEED\PBHelper.dll
O2 - BHO: (no name) - {4FFC38CA-FEA4-486D-8898-0DE8735986FE} - D:\WINDOWS\system32\ursqo.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - D:\Program Files\ONSPEED\components\NOWImaging.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {C6208197-F4CB-49E6-A545-1077901F40E2} - D:\WINDOWS\system32\pqsxwico.dll (file missing)
O2 - BHO: (no name) - {CEF4E681-94FB-430E-8881-C852A64F953a} - D:\WINDOWS\system32\pqsxwico.dll (file missing)
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - D:\WINDOWS\system32\mvaqamjl.dll (file missing)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: ONSPEED - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - D:\Program Files\ONSPEED\TOOLBAND.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SlipStream] "D:\Program Files\ONSPEED\onspeedcore.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [j3291833] rundll32 D:\WINDOWS\system32\j3291833.dll sook
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Gigaget] "D:\Program Files\Giganology\Gigaget\GigagetShell.exe" /s
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: ONSPEED.lnk = D:\Program Files\ONSPEED\onspeedgui.exe
O4 - Global Startup: ZDWLan Utility.lnk = D:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - D:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O14 - IERESET.INF: START_PAGE_URL=www.google.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8231B338-7019-45B2-8BEE-27F228CA340F}: NameServer = 217.175.160.11,217.175.160.12
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB4A5D77-A13E-4517-B28A-DE447F462FD4}: NameServer = 217.175.160.11 217.175.160.12
O17 - HKLM\System\CS1\Services\Tcpip\..\{8231B338-7019-45B2-8BEE-27F228CA340F}: NameServer = 217.175.160.11,217.175.160.12
O17 - HKLM\System\CS2\Services\Tcpip\..\{8231B338-7019-45B2-8BEE-27F228CA340F}: NameServer = 217.175.160.11,217.175.160.12
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: ddcbbyy - ddcbbyy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - BOONTY - D:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

Merci beaucoup de ton aide

Ps: j'ai trouver un reel changement avec avoir utiliser vundofix; je trouve mon ordi plus rapide

Bonjour voila mon rapport de clean

13/06/2007 a 11:46:56,68

*** Recherche des fichiers dans D:

*** Recherche des fichiers dans D:\WINDOWS\

*** Recherche des fichiers dans D:\WINDOWS\system32
D:\WINDOWS\system32\mcrh.tmp FOUND

*** Recherche des fichiers dans D:\Program Files
"D:\Program Files\DaemonTools_WhenUSave_Installer\" FOUND
*** Fin du rapport !

et mon rapport bitdefender

BitDefender Online Scanner

Scan report generated at: Wed, Jun 13, 2007 - 14:34:13

Scan path: D:\;

Statistics

Time

02:15:12

Files

200063

Folders

6134

Boot Sectors

4

Archives

3901

Packed Files

5900

Results

Identified Viruses

13

Infected Files

21

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

21

Engines Info

Virus Definitions

513410

Engine build

AVCORE v1.0 (build 2409) (i386) (May 9 2007 18:01:21)

Scan plugins

14

Archive plugins

38

Unpack plugins

6

E-mail plugins

6

System plugins

1

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

D:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe

Infected with: Generic.Adw.SaveNow.F5FEB660

D:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe

Disinfection failed

D:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe

Deleted

D:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)

Update failed

D:\System Volume Information\_restore{373297B8-7A28-4B94-9463-5DEB165E2259}\RP30\A0040804.exe

Infected with: Worm.RJump.K

D:\System Volume Information\_restore{373297B8-7A28-4B94-9463-5DEB165E2259}\RP30\A0040804.exe

Disinfection failed

D:\System Volume Information\_restore{373297B8-7A28-4B94-9463-5DEB165E2259}\RP30\A0040804.exe

Deleted

D:\System Volume Information\_restore{373297B8-7A28-4B94-9463-5DEB165E2259}\RP30\A0040806.exe

Infected with: Worm.RJump.K

D:\System Volume Information\_restore{373297B8-7A28-4B94-9463-5DEB165E2259}\RP30\A0040806.exe

Disinfection failed

D:\System Volume Information\_restore{373297B8-7A28-4B94-9463-5DEB165E2259}\RP30\A0040806.exe

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP33\A0087370.exe=>(RAR Sfx o)=>interlligentwordpad.exe

Detected with: Application.Joke.IWPad

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP33\A0087370.exe=>(RAR Sfx o)=>interlligentwordpad.exe

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP33\A0087370.exe=>(RAR Sfx o)=>interlligentwordpad.exe

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP33\A0087370.exe=>(RAR Sfx o)

Update failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP39\A0092485.exe=>(RAR Sfx o)=>keygen.exe

Infected with: Trojan.Downloader.Small.BHH

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP39\A0092485.exe=>(RAR Sfx o)=>keygen.exe

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP39\A0092485.exe=>(RAR Sfx o)=>keygen.exe

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP39\A0092485.exe=>(RAR Sfx o)

Update failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP41\A0100516.dll

Infected with: Trojan.Vundo.DLY

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP41\A0100516.dll

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP41\A0100516.dll

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP45\A0108489.dll

Infected with: Trojan.Vundo.AY

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP45\A0108489.dll

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP45\A0108489.dll

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133650.dll

Infected with: Trojan.Virtumod.ALZ

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133650.dll

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133650.dll

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133651.dll

Infected with: GenPack:Trojan.Vundo.DLZ

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133651.dll

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133651.dll

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133652.dll

Infected with: Trojan.Vundo.DLV

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133652.dll

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133652.dll

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133653.exe

Infected with: Trojan.Clicker.Small.YB

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133653.exe

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133653.exe

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133656.exe

Infected with: Trojan.LowZones.SA

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133656.exe

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133656.exe

Deleted

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133658.dll

Infected with: MemScan:Trojan.BHO.BM

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133658.dll

Disinfection failed

D:\System Volume Information\_restore{3B0B06A3-BE4B-48FE-91C5-222D27B22C49}\RP50\A0133658.dll

Deleted

D:\VundoFix Backups\ecaxtpnj.dll.bad

Infected with: Trojan.Virtumod.ALZ

D:\VundoFix Backups\ecaxtpnj.dll.bad

Disinfection failed

D:\VundoFix Backups\ecaxtpnj.dll.bad

Deleted

D:\VundoFix Backups\emcsyeux.dll.bad

Infected with: GenPack:Trojan.Vundo.DLZ

D:\VundoFix Backups\emcsyeux.dll.bad

Disinfection failed

D:\VundoFix Backups\emcsyeux.dll.bad

Deleted

D:\VundoFix Backups\hiuwroqp.dll.bad

Infected with: Trojan.Vundo.DLV

D:\VundoFix Backups\hiuwroqp.dll.bad

Disinfection failed

D:\VundoFix Backups\hiuwroqp.dll.bad

Deleted

D:\VundoFix Backups\laplgvqm.exe.bad

Infected with: Trojan.Clicker.Small.YB

D:\VundoFix Backups\laplgvqm.exe.bad

Disinfection failed

D:\VundoFix Backups\laplgvqm.exe.bad

Deleted

D:\VundoFix Backups\twbhovcu.exe.bad

Infected with: Trojan.LowZones.SA

D:\VundoFix Backups\twbhovcu.exe.bad

Disinfection failed

D:\VundoFix Backups\twbhovcu.exe.bad

Deleted

D:\VundoFix Backups\yugcmied.dll.bad

Infected with: MemScan:Trojan.BHO.BM

D:\VundoFix Backups\yugcmied.dll.bad

Disinfection failed

D:\VundoFix Backups\yugcmied.dll.bad

Deleted

D:\WINDOWS\system32\lyorgira.dll

Infected with: Trojan.BHO.BP

D:\WINDOWS\system32\lyorgira.dll

Disinfection failed

D:\WINDOWS\system32\lyorgira.dll

Deleted

D:\WINDOWS\system32\__delete_on_reboot__j_3_2_9_1_8_3_3_._d_l_l_

Infected with: Trojan.Clicker.Small.YB

D:\WINDOWS\system32\__delete_on_reboot__j_3_2_9_1_8_3_3_._d_l_l_

Disinfection failed

D:\WINDOWS\system32\__delete_on_reboot__j_3_2_9_1_8_3_3_._d_l_l_

Deleted

merci pour tout

Bonjour

Supprime ce dossier : D:\VundoFix Backups

¤ Pour Clean :

- Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu..
Entre dans le dossier Clean
Double clic sur clean ou clean.cmd et choisis l'option 2
Dès qu'il a terminé redémarre normalement.

¤ Pour terminer :

Alors ceci : C:\System Volume Information\_restore (voir rapport Bitdefender )
indique que ta restauration du système etait infecté ou est infecté, pour être sûr, nous allons créer un point propre.

Clic sur "demarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du système"

¤ coches la case "desactiver la restauration du systéme sur tous les lecteurs", puis clic ur "appliquer"
¤ décoches la case et clic sur "appliquer" puis "ok".

Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre :

Clic sur "demarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, clic sur "créer" puis "ok".
Voilà, maintenant le point de restauration est créé
Si un jour tu le décides, tu pourras revenir en arrière à la date que tu as créé ce point de restauration.
En exécutant la restauration du système tu pourras remettre ton ordinateur à la date ou l'on à créé ce point de restauration mais tu perdras les modifications que tu auras fait entre deux.

Puis dis moi comment se comporte ton PC ;-)