je crois que j'ai attrapé le virus virtumondo et je ne sais pas comment m'en débarrasser. Ni mon antivirus (AVG puis Avast) ni mes antispywares (AVG, Ccleaner, Spybot et Ad Aware) n'y arrivent...
J'ai téléchargé virtumondobegone, fait une analyse, voilà les rapports...
Si quelqu'un pouvait m'aider, merci d'avance.
Rapport VBG :
[10/21/2007, 16:05:28] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Julien\Bureau\VirtumundoBeGone.exe" )
[10/21/2007, 16:05:35] - Detected System Information:
[10/21/2007, 16:05:35] - Windows Version: 5.1.2600, Service Pack 2
[10/21/2007, 16:05:35] - Current Username: Julien (Admin)
[10/21/2007, 16:05:35] - Windows is in NORMAL mode.
[10/21/2007, 16:05:35] - Searching for Browser Helper Objects:
[10/21/2007, 16:05:35] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/21/2007, 16:05:35] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/21/2007, 16:05:35] - BHO 3: {7b98f4d3-ab63-4274-91b5-8396c5d90c6d} ()
[10/21/2007, 16:05:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/21/2007, 16:05:35] - Checking for HKLM\...\Winlogon\Notify\kbdlmn
[10/21/2007, 16:05:35] - Found: HKLM\...\Winlogon\Notify\kbdlmn - This is probably Virtumundo.
[10/21/2007, 16:05:35] - Assigning {7b98f4d3-ab63-4274-91b5-8396c5d90c6d} MSEvents Object
[10/21/2007, 16:05:35] - BHO list has been changed! Starting over...
[10/21/2007, 16:05:35] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/21/2007, 16:05:35] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/21/2007, 16:05:35] - BHO 3: {7b98f4d3-ab63-4274-91b5-8396c5d90c6d} (MSEvents Object)
[10/21/2007, 16:05:35] - ALERT: Found MSEvents Object!
[10/21/2007, 16:05:35] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/21/2007, 16:05:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/21/2007, 16:05:35] - No filename found. Continuing.
[10/21/2007, 16:05:35] - BHO 5: {BACEB7AF-8D88-456E-82D0-7BEB9A4410FE} ()
[10/21/2007, 16:05:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/21/2007, 16:05:35] - No filename found. Continuing.
[10/21/2007, 16:05:35] - BHO 6: {F855B6D4-839F-4140-8711-8C32EE0CF2F6} ()
[10/21/2007, 16:05:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/21/2007, 16:05:36] - No filename found. Continuing.
[10/21/2007, 16:05:36] - Finished Searching Browser Helper Objects
[10/21/2007, 16:05:36] - *** Detected MSEvents Object
[10/21/2007, 16:05:36] - Trying to remove MSEvents Object...
[10/21/2007, 16:05:37] - Terminating Process: IEXPLORE.EXE
[10/21/2007, 16:05:37] - Terminating Process: RUNDLL32.EXE
[10/21/2007, 16:05:37] - Disabling Automatic Shell Restart
[10/21/2007, 16:05:37] - Terminating Process: EXPLORER.EXE
[10/21/2007, 16:05:37] - Suspending the NT Session Manager System Service
[10/21/2007, 16:05:37] - Terminating Windows NT Logon/Logoff Manager
[10/21/2007, 16:05:38] - Re-enabling Automatic Shell Restart
[10/21/2007, 16:05:38] - File to disable: C:\WINDOWS\system32\kbdlmn.dll
[10/21/2007, 16:05:38] - Removing HKLM\...\Browser Helper Objects\{7b98f4d3-ab63-4274-91b5-8396c5d90c6d}
[10/21/2007, 16:05:38] - Removing HKCR\CLSID\{7b98f4d3-ab63-4274-91b5-8396c5d90c6d}
[10/21/2007, 16:05:38] - Adding Kill Bit for ActiveX for GUID: {7b98f4d3-ab63-4274-91b5-8396c5d90c6d}
[10/21/2007, 16:05:38] - Deleting ATLEvents/MSEvents Registry entries
[10/21/2007, 16:05:38] - Removing HKLM\...\Winlogon\Notify\kbdlmn
[10/21/2007, 16:05:38] - Searching for Browser Helper Objects:
[10/21/2007, 16:05:38] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/21/2007, 16:05:38] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/21/2007, 16:05:38] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/21/2007, 16:05:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/21/2007, 16:05:38] - No filename found. Continuing.
[10/21/2007, 16:05:38] - BHO 4: {BACEB7AF-8D88-456E-82D0-7BEB9A4410FE} ()
[10/21/2007, 16:05:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/21/2007, 16:05:38] - No filename found. Continuing.
[10/21/2007, 16:05:38] - BHO 5: {F855B6D4-839F-4140-8711-8C32EE0CF2F6} ()
[10/21/2007, 16:05:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/21/2007, 16:05:38] - No filename found. Continuing.
[10/21/2007, 16:05:38] - Finished Searching Browser Helper Objects
[10/21/2007, 16:05:38] - Finishing up...
[10/21/2007, 16:05:38] - A restart is needed.
[10/21/2007, 16:05:46] - Attempting to Restart via STOP error (Blue Screen!)
Rapport Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:52:02, on 21/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
!^^![ME]
Messages postés4744Date d'inscriptiondimanche 10 juin 2007StatutContributeurDernière intervention 1 mars 2020395 21 oct. 2007 à 19:59
salut,
Télécharge VundoFix.exe par Atribune http://www.atribune.org/content/view/24/2/ sur ton Bureau.
* Double-clique sur VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est terminé, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique sur OK
--> Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".
Un hacker sachant hacker sans infections est pour moi un bon hacker
bloginformatique.blogspot.com
