Au secours

tu as une infection vundo
va voir ici et reviens nous mettre les rapports
supprimer le trojan vundo virtumonde

merci de ton aide kris6943,

je viens de faire tourner les 3 logiciel vundo et voila leurs resultats + celui de hijackthis

VundoFix V6.5.7

Checking Java version...

Java version is 1.4.2.4
Old versions of java are exploitable and should be removed.

Scan started at 16:47:03 29/08/2007

Listing files found while scanning....

C:\WINDOWS\bbabcf.ini
C:\WINDOWS\fcbabb.dll
C:\WINDOWS\System32\jkhhh.dll

Beginning removal...

Attempting to delete C:\WINDOWS\bbabcf.ini
C:\WINDOWS\bbabcf.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.7

Checking Java version...

Java version is 1.4.2.4
Old versions of java are exploitable and should be removed.

Scan started at 16:58:10 29/08/2007

Listing files found while scanning....

No infected files were found.

______________________________________________________

[08/29/2007, 16:49:54] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\michel\Bureau\VirtumundoBeGone.exe" )
[08/29/2007, 16:50:07] - Detected System Information:
[08/29/2007, 16:50:07] - Windows Version: 5.1.2600, Service Pack 1
[08/29/2007, 16:50:07] - Current Username: michel (Admin)
[08/29/2007, 16:50:07] - Windows is in NORMAL mode.
[08/29/2007, 16:50:07] - Searching for Browser Helper Objects:
[08/29/2007, 16:50:07] - BHO 1: {430B71DC-2645-4810-9E05-3E4D6A78FBC8} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - Checking for HKLM\...\Winlogon\Notify\jkhhh
[08/29/2007, 16:50:07] - Found: HKLM\...\Winlogon\Notify\jkhhh - This is probably Virtumundo.
[08/29/2007, 16:50:07] - Assigning {430B71DC-2645-4810-9E05-3E4D6A78FBC8} MSEvents Object
[08/29/2007, 16:50:07] - BHO list has been changed! Starting over...
[08/29/2007, 16:50:07] - BHO 1: {430B71DC-2645-4810-9E05-3E4D6A78FBC8} (MSEvents Object)
[08/29/2007, 16:50:07] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:07] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/29/2007, 16:50:07] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - No filename found. Continuing.
[08/29/2007, 16:50:07] - BHO 4: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - No filename found. Continuing.
[08/29/2007, 16:50:07] - BHO 5: {C84D8A0A-E708-42B6-90CA-9C30956A87C6} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - Checking for HKLM\...\Winlogon\Notify\xxyyxxy
[08/29/2007, 16:50:07] - Found: HKLM\...\Winlogon\Notify\xxyyxxy - This is probably Virtumundo.
[08/29/2007, 16:50:07] - Assigning {C84D8A0A-E708-42B6-90CA-9C30956A87C6} MSEvents Object
[08/29/2007, 16:50:07] - BHO list has been changed! Starting over...
[08/29/2007, 16:50:07] - BHO 1: {430B71DC-2645-4810-9E05-3E4D6A78FBC8} (MSEvents Object)
[08/29/2007, 16:50:07] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:07] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/29/2007, 16:50:07] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - No filename found. Continuing.
[08/29/2007, 16:50:07] - BHO 4: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - No filename found. Continuing.
[08/29/2007, 16:50:07] - BHO 5: {C84D8A0A-E708-42B6-90CA-9C30956A87C6} (MSEvents Object)
[08/29/2007, 16:50:07] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:07] - BHO 6: {d54791c0-65e3-40eb-ba61-7b018072f12b} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - Checking for HKLM\...\Winlogon\Notify\iasmgr
[08/29/2007, 16:50:07] - Found: HKLM\...\Winlogon\Notify\iasmgr - This is probably Virtumundo.
[08/29/2007, 16:50:07] - Assigning {d54791c0-65e3-40eb-ba61-7b018072f12b} MSEvents Object
[08/29/2007, 16:50:07] - BHO list has been changed! Starting over...
[08/29/2007, 16:50:07] - BHO 1: {430B71DC-2645-4810-9E05-3E4D6A78FBC8} (MSEvents Object)
[08/29/2007, 16:50:07] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:07] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/29/2007, 16:50:07] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - No filename found. Continuing.
[08/29/2007, 16:50:07] - BHO 4: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/29/2007, 16:50:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:07] - No filename found. Continuing.
[08/29/2007, 16:50:07] - BHO 5: {C84D8A0A-E708-42B6-90CA-9C30956A87C6} (MSEvents Object)
[08/29/2007, 16:50:07] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:07] - BHO 6: {d54791c0-65e3-40eb-ba61-7b018072f12b} (MSEvents Object)
[08/29/2007, 16:50:07] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:07] - Finished Searching Browser Helper Objects
[08/29/2007, 16:50:07] - *** Detected MSEvents Object
[08/29/2007, 16:50:07] - Trying to remove MSEvents Object...
[08/29/2007, 16:50:08] - Terminating Process: IEXPLORE.EXE
[08/29/2007, 16:50:09] - Terminating Process: RUNDLL32.EXE
[08/29/2007, 16:50:11] - Disabling Automatic Shell Restart
[08/29/2007, 16:50:11] - Terminating Process: EXPLORER.EXE
[08/29/2007, 16:50:12] - Suspending the NT Session Manager System Service
[08/29/2007, 16:50:13] - Terminating Windows NT Logon/Logoff Manager
[08/29/2007, 16:50:14] - Re-enabling Automatic Shell Restart
[08/29/2007, 16:50:14] - File to disable: C:\WINDOWS\System32\jkhhh.dll
[08/29/2007, 16:50:14] - Removing HKLM\...\Browser Helper Objects\{430B71DC-2645-4810-9E05-3E4D6A78FBC8}
[08/29/2007, 16:50:15] - Removing HKCR\CLSID\{430B71DC-2645-4810-9E05-3E4D6A78FBC8}
[08/29/2007, 16:50:15] - Adding Kill Bit for ActiveX for GUID: {430B71DC-2645-4810-9E05-3E4D6A78FBC8}
[08/29/2007, 16:50:15] - Deleting ATLEvents/MSEvents Registry entries
[08/29/2007, 16:50:15] - Removing HKLM\...\Winlogon\Notify\jkhhh
[08/29/2007, 16:50:15] - Searching for Browser Helper Objects:
[08/29/2007, 16:50:15] - BHO 1: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/29/2007, 16:50:15] - BHO 2: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/29/2007, 16:50:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:15] - No filename found. Continuing.
[08/29/2007, 16:50:15] - BHO 3: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/29/2007, 16:50:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:15] - No filename found. Continuing.
[08/29/2007, 16:50:15] - BHO 4: {C84D8A0A-E708-42B6-90CA-9C30956A87C6} (MSEvents Object)
[08/29/2007, 16:50:15] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:15] - BHO 5: {d54791c0-65e3-40eb-ba61-7b018072f12b} (MSEvents Object)
[08/29/2007, 16:50:15] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:15] - Finished Searching Browser Helper Objects
[08/29/2007, 16:50:15] - *** Detected MSEvents Object
[08/29/2007, 16:50:16] - Trying to remove MSEvents Object...
[08/29/2007, 16:50:17] - Terminating Process: IEXPLORE.EXE
[08/29/2007, 16:50:17] - Terminating Process: RUNDLL32.EXE
[08/29/2007, 16:50:17] - Disabling Automatic Shell Restart
[08/29/2007, 16:50:17] - Terminating Process: EXPLORER.EXE
[08/29/2007, 16:50:18] - Suspending the NT Session Manager System Service
[08/29/2007, 16:50:18] - Terminating Windows NT Logon/Logoff Manager
[08/29/2007, 16:50:18] - Re-enabling Automatic Shell Restart
[08/29/2007, 16:50:18] - File to disable: C:\WINDOWS\system32\xxyyxxy.dll
[08/29/2007, 16:50:18] - Removing HKLM\...\Browser Helper Objects\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}
[08/29/2007, 16:50:18] - Removing HKCR\CLSID\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}
[08/29/2007, 16:50:18] - Adding Kill Bit for ActiveX for GUID: {C84D8A0A-E708-42B6-90CA-9C30956A87C6}
[08/29/2007, 16:50:18] - Deleting ATLEvents/MSEvents Registry entries
[08/29/2007, 16:50:18] - Removing HKLM\...\Winlogon\Notify\xxyyxxy
[08/29/2007, 16:50:18] - Searching for Browser Helper Objects:
[08/29/2007, 16:50:18] - BHO 1: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/29/2007, 16:50:18] - BHO 2: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/29/2007, 16:50:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:18] - No filename found. Continuing.
[08/29/2007, 16:50:18] - BHO 3: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/29/2007, 16:50:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:18] - No filename found. Continuing.
[08/29/2007, 16:50:18] - BHO 4: {d54791c0-65e3-40eb-ba61-7b018072f12b} (MSEvents Object)
[08/29/2007, 16:50:18] - ALERT: Found MSEvents Object!
[08/29/2007, 16:50:18] - Finished Searching Browser Helper Objects
[08/29/2007, 16:50:18] - *** Detected MSEvents Object
[08/29/2007, 16:50:18] - Trying to remove MSEvents Object...
[08/29/2007, 16:50:19] - Terminating Process: IEXPLORE.EXE
[08/29/2007, 16:50:20] - Terminating Process: RUNDLL32.EXE
[08/29/2007, 16:50:20] - Disabling Automatic Shell Restart
[08/29/2007, 16:50:20] - Terminating Process: EXPLORER.EXE
[08/29/2007, 16:50:20] - Suspending the NT Session Manager System Service
[08/29/2007, 16:50:20] - Terminating Windows NT Logon/Logoff Manager
[08/29/2007, 16:50:20] - Re-enabling Automatic Shell Restart
[08/29/2007, 16:50:20] - File to disable: C:\WINDOWS\system32\iasmgr.dll
[08/29/2007, 16:50:20] - Renaming C:\WINDOWS\system32\iasmgr.dll -> C:\WINDOWS\system32\iasmgr.dll.vir
[08/29/2007, 16:50:20] - File successfully renamed!
[08/29/2007, 16:50:20] - Removing HKLM\...\Browser Helper Objects\{d54791c0-65e3-40eb-ba61-7b018072f12b}
[08/29/2007, 16:50:20] - Removing HKCR\CLSID\{d54791c0-65e3-40eb-ba61-7b018072f12b}
[08/29/2007, 16:50:20] - Adding Kill Bit for ActiveX for GUID: {d54791c0-65e3-40eb-ba61-7b018072f12b}
[08/29/2007, 16:50:20] - Deleting ATLEvents/MSEvents Registry entries
[08/29/2007, 16:50:20] - Removing HKLM\...\Winlogon\Notify\iasmgr
[08/29/2007, 16:50:20] - Searching for Browser Helper Objects:
[08/29/2007, 16:50:20] - BHO 1: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/29/2007, 16:50:20] - BHO 2: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/29/2007, 16:50:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:20] - No filename found. Continuing.
[08/29/2007, 16:50:20] - BHO 3: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/29/2007, 16:50:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 16:50:20] - No filename found. Continuing.
[08/29/2007, 16:50:20] - Finished Searching Browser Helper Objects
[08/29/2007, 16:50:20] - Finishing up...
[08/29/2007, 16:50:20] - A restart is needed.
[08/29/2007, 16:50:25] - Attempting to Restart via STOP error (Blue Screen!)

[08/29/2007, 17:02:21] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\michel\Bureau\VirtumundoBeGone.exe" )
[08/29/2007, 17:02:28] - Detected System Information:
[08/29/2007, 17:02:28] - Windows Version: 5.1.2600, Service Pack 1
[08/29/2007, 17:02:28] - Current Username: michel (Admin)
[08/29/2007, 17:02:28] - Windows is in NORMAL mode.
[08/29/2007, 17:02:28] - Searching for Browser Helper Objects:
[08/29/2007, 17:02:28] - BHO 1: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/29/2007, 17:02:28] - BHO 2: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/29/2007, 17:02:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/29/2007, 17:02:28] - No filename found. Continuing.
[08/29/2007, 17:02:28] - Finished Searching Browser Helper Objects
[08/29/2007, 17:02:28] - Finishing up...
[08/29/2007, 17:02:28] - Nothing found! Exiting...

______________________________________________________________________

ComboFix 07-08-29.3 - "michel" 2007-08-29 17:08:35.1 - NTFSx86 MINIMAL
Microsoft Windows XP dition familiale 5.1.2600.1.1252.1.1036.18.103 [GMT 2:00]

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ddabcaw.dll

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-29 )))))))))))))))))))))))))))))))

2007-08-29 17:03 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-29 16:53 933 --a------ C:\WINDOWS\system32\awtsp.exe
2007-08-29 16:47 <REP> d-------- C:\VundoFix Backups
2007-08-29 14:13 608,256 --a------ C:\WINDOWS\system32\dllcache\xpsp2res.dll
2007-08-29 13:39 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-08-29 13:16 <REP> d-------- C:\Program Files\Navilog1
2007-08-28 19:03 <REP> d-------- C:\Program Files\Yahoo!
2007-08-28 18:59 <REP> d-------- C:\Program Files\CCleaner
2007-08-28 15:56 <REP> d-------- C:\WINDOWS\AU_Temp
2007-08-28 14:32 <REP> d-------- C:\WINDOWS\report
2007-08-28 14:30 86,094 --a------ C:\WINDOWS\BPMNT.dll
2007-08-28 14:30 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2007-08-28 14:30 267,845 --a------ C:\WINDOWS\tsc.exe
2007-08-28 14:30 1,163,344 --a------ C:\WINDOWS\vsapi32.dll
2007-08-28 14:30 <REP> d-------- C:\WINDOWS\AU_Backup
2007-08-28 14:27 <REP> d-------- C:\WINDOWS\AU_Log
2007-08-28 14:26 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2007-08-28 14:26 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2007-08-28 14:26 286,720 --a------ C:\WINDOWS\PATCH.EXE
2007-08-28 14:17 <REP> d-------- C:\DOCUME~1\michel\APPLIC~1\WinRAR
2007-08-28 13:33 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-28 12:28 266,240 --a------ C:\WINDOWS\system32\mstask.dll
2007-08-28 12:28 174,592 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-08-28 12:28 10,752 --a------ C:\WINDOWS\system32\mstinit.exe
2007-08-28 12:08 1,006,592 --a------ C:\WINDOWS\system32\esent.dll
2007-08-28 11:40 <REP> d-------- C:\WINDOWS\system32\bits
2007-08-28 11:37 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-08-28 11:37 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-08-28 11:36 7,680 --------- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2007-08-28 11:36 7,680 --------- C:\WINDOWS\system32\bitsprx2.dll
2007-08-28 11:36 7,168 --------- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2007-08-28 11:36 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2007-08-28 11:36 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2007-08-28 11:36 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-08-28 11:11 <REP> d-------- C:\DOCUME~1\michel\Contacts
2007-08-28 11:08 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-08-28 11:07 <REP> d-------- C:\Program Files\MSN Messenger
2007-08-28 11:02 6,763 --------- C:\WINDOWS\system32\hhhkj.ini2
2007-08-28 10:49 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-08-28 10:49 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-08-28 10:49 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-08-28 10:49 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-08-28 10:37 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-08-28 10:31 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-08-28 10:31 <REP> d-------- C:\Program Files\Microsoft.NET
2007-08-28 10:29 6,448 --------- C:\WINDOWS\system32\hhhkj.bak1
2007-08-28 10:28 <REP> dr-h----- C:\MSOCache
2007-08-28 10:20 <REP> d---s---- C:\DOCUME~1\michel\UserData
2007-08-28 09:58 <REP> d-------- C:\DOCUME~1\michel\APPLIC~1\Bitdefender
2007-08-28 09:57 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
2007-08-28 09:37 <REP> dr------- C:\DOCUME~1\michel\Mes documents
2007-08-28 09:37 <REP> dr------- C:\DOCUME~1\michel\Menu D‚marrer
2007-08-28 09:37 <REP> dr------- C:\DOCUME~1\michel\Favoris
2007-08-28 09:37 <REP> dr------- C:\DOCUME~1\michel\Bureau
2007-08-28 09:37 <REP> d--h----- C:\DOCUME~1\michel\Voisinage r‚seau
2007-08-28 09:37 <REP> d--h----- C:\DOCUME~1\michel\Voisinage d'impression
2007-08-28 09:37 <REP> d--h----- C:\DOCUME~1\michel\ModŠles
2007-08-27 23:59 <REP> d-------- C:\Program Files\Common Files
2007-08-27 23:55 516,096 --a------ C:\WINDOWS\system32\ati2sgag.exe
2007-08-27 23:55 <REP> d-------- C:\Program Files\ATI Technologies
2007-08-27 23:54 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2007-08-27 23:54 <REP> d-------- C:\Program Files\Fichiers communs\InstallShield
2007-08-27 23:54 <REP> d-------- C:\Program Files\Analog Devices
2007-08-27 23:53 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-08-27 23:51 <REP> d-------- C:\WINDOWS\system32\URTTemp
2007-08-27 23:49 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-08-27 23:49 55,680 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2007-08-27 23:49 50,560 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2007-08-27 23:49 4,736 --a------ C:\WINDOWS\system32\drivers\usbd.sys
2007-08-27 23:39 <REP> d--h----- C:\PNP
2007-08-27 23:26 <REP> d--hs---- C:\DRIVERS
2007-08-27 23:25 <REP> d--h----- C:\DIVTOOLS
2007-08-27 23:19 <REP> d-------- C:\APPS
2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-27 23:54 44 --a------ C:\WINDOWS\system32\msssc.dll
2007-08-27 23:50 0 --a------ C:\WINDOWS\system32\spxx.exe
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-07-30 10:08]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 21:10]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-04-02 16:48]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" []
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" []

__________________________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 17:22, on 2007-08-29
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\michel\Mes documents\dossier pour laurent\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Merci encore pour ton aide

Papi67

je viens de faire tourner clean qui me dit que je suis surement infecter par Vundo, mais bitdefender me dis qu'il n'y a pas de virus ??

je comprend plus rien moi

Clean Navipromo version 2.0.9 commencé le 2007-08-29 à 17:31:53.32

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 20.08.2007 a 22h30 by IL-MAFIOSO

Mode suppression automatique avec prise en charge résultats Blacklight

*** fsbl1.txt non trouvé ***
(Assurez-vous que Blacklight n'avait rien trouvé lors de la recherche)

*** Recherche avec GenericNaviSearch ***
!!! Ces résultats peuvent révéler des fichiers légitimes !!!
!!! A verifier impérativement avant toute suppression manuelle !!!

Fichiers trouvés supprimés avec backups :

Aucun Fichier trouvé !

Fichiers suspects :

Aucun Fichier suspect trouvé !

*** Suppression dossiers dans C:\WINDOWS ***

*** Suppression dossiers dans C:\Program Files ***

*** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Suppression dossiers dans C:\Documents and Settings\michel\Application Data ***

*** Suppression fichiers ***

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\michel\Local Settings\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

C:\WINDOWS\system32\hhhkj.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\hhhkj.bak1 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche et Suppression Heuristique :

*
**
***
****
*****
******
*******
********

3)Certificats :

Certificat Egroup absent !

*** Sauvegarde du registre vers dossier Backupnavi ***

sauvegarde du registre réalise avec succes !

*** Nettoyage registre ***

Erreur application fixreg

Le registre n'a pas été nettoyé !

*** Nettoyage termine le 2007-08-29 à 17:35:08.26 ***

__________________________________________________________

//-----------------------------------------------------------------
//
// Produit BitDefender Internet Security v10
// Produit 10.2
//
// Créé le: 29/08/2007 17:36:57
//
//-----------------------------------------------------------------

Statistiques

Chemin cible: C:\WINDOWS
C:\Program Files
Dossiers : 1666
Fichiers : 7691
Processus Mémoire analysés : 0
Archives : 2
Fichiers enpaquetés : 336
Virus trouvés : 0
Fichiers infectés : 0
Processus Mémoire infectés : 0
Fichiers suspects : 0
Alertes : 0
Fichiers désinfectés : 0
Fichiers effacés : 0
Fichiers déplacés : 0
Erreurs I/O : 0
Temps d'analyse :=00:09:09
Fichiers/seconde :14

Définitions virus : 815101
Plugins d'analyse : 16
Plugins archives : 41
Plug-ins décompression : 6
Plug-ins messagerie : 6
Plug-ins système : 5

Options d'analyse

Détection
[X] Analyser le secteur de boot
[ ] Processus mémoire
[ ] Analyser les archives
[X] Analyser les fichiers enpaquetés
[X] Analyser la messagerie

Masque fichiers
[X] Programmes
[ ] Tous les fichiers
[ ] Extensions définies par l'utilisateur:
[ ] Exclure les extensions: ;

Action

Objets infectés
[ ] Ignorer
[X] Désinfecter
[ ] Effacer
[ ] Mettre en quarantaine
[ ] Demander l'action

Seconde action
[ ] Ignorer
[ ] Effacer
[X] Mettre en quarantaine
[ ] Demander l'action

Options d'analyse
[X] Activer les alertes
[ ] Activer l'heuristique
[ ] Afficher tous les fichiers dans le journal
[X] Fichier journal: C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\quick_scan\1188401817.log

Options d'analyse Spyware

[X] Analyse contre les risques non-viraux
[ ] Ecarter de l'analyse les dialers et les applications
[ ] Clés de registres
[ ] Cookies

vundofix a bien trouvé l'infection de trois fichiers
Listing files found while scanning....

C:\WINDOWS\bbabcf.ini
C:\WINDOWS\fcbabb.dll
C:\WINDOWS\System32\jkhhh.dll

mais apparemment il n'en a supprimé qu'un seul
Beginning removal...

Attempting to delete C:\WINDOWS\bbabcf.ini
C:\WINDOWS\bbabcf.ini Has been deleted!


renommes ces deux là manuellement
ce sont peut-être et même probablement des fichiers cachés
alors va dans les options des dossiers, onglet affichage et coches les cases adequat
clic sur les fichiers > renommer > et tu rajoutes a leur nom .vir
fcbabb.dll situé dans C:\WINDOWS
jkhhh.dll situé dans C:\WINDOWS\System32

essaye de refaire la procédure vundofix en mode sans echec avec prise en charge réseau

PS Navilog ne sert a rien contre une infection Vundo et AUCUN antivirus n'est capable de le supprimer

ok

je refais

salut

a 1ere vu tous et rentre dans l'ordre, et je t'en remercie bien bas.

VundoFix V6.5.7

Checking Java version...

Java version is 1.4.2.4
Old versions of java are exploitable and should be removed.

Scan started at 12:17:19 2007-08-30

Listing files found while scanning....

No infected files were found.

Encore merci
qu'aurais-je fais sans toi

Papi67

renommes ces deux là manuellement
ce sont peut-être et même probablement des fichiers cachés
alors va dans les options des dossiers, onglet affichage et coches les cases adequat
clic sur les fichiers > renommer > et tu rajoutes a leur nom .vir
fcbabb.dll situé dans C:\WINDOWS
jkhhh.dll situé dans C:\WINDOWS\System32

salut

j'ai cherche mais rien trouver