Sujet Précédent Sujet Suivant

Présence de troyans... help, merci !

Résolu
phil.douai Messages postés 13 Statut Membre -  
nardino Messages postés 1634 Statut Membre -
Bonjour,

Je vous joint le rapport hijackthis... MERCI !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:11:47, on 13/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\LYC457.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\spyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/040C/bl8.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/040C/bl7.asp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/040C/bl7.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Imprimante GedExpertPDF.lnk = C:\Program Files\AWAZUR\AWClientSQL\AWMonitor.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {F11BFF96-CC7A-4482-819B-91EAE4C454EF} (NTR ActiveX 1.1.6) - http://www.inquiero.com/inquiero/mod/setup/ntractivex116_14.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fidexpert.fidexpert.fr
O17 - HKLM\Software\..\Telephony: DomainName = fidexpert.fidexpert.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{4913F47C-2946-48A2-AF9C-84086BBCB134}: NameServer = 194.2.0.20,194.2.0.50
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fidexpert.fidexpert.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{4913F47C-2946-48A2-AF9C-84086BBCB134}: NameServer = 194.2.0.20,194.2.0.50
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fidexpert.fidexpert.fr
O17 - HKLM\System\CS2\Services\Tcpip\..\{4913F47C-2946-48A2-AF9C-84086BBCB134}: NameServer = 194.2.0.20,194.2.0.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c001AEF1.dat
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Scan en temps réel Trend Micro Client/Server Security Agent (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: Pare-feu personnel Trend Micro Client/Server Security Agent (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend Micro Client-Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

11 réponses

Réponse 1 / 11
nardino Messages postés 1634 Statut Membre 119
 
Bonjour.
1-Télécharge VundoFix de Atribune :
http://www.atribune.org/ccount/click.php?id=4

[*]Double clic sur Vundofix.exe.
[*]Coche la case Run VundoFix as a task
[*]Répond OK au popup qui s'ouvre.
Il va se refermer et réouvrir au bout d'une minute environ.
[*]Quand il est rouvert, clique sur Scan for Vundo
[*]Quand le scan est terminé, clique sur Remove Vundo
[*]Réponds Yes à la demande de suppression des fichiers.
[*]Il te sera demandé de redémarrer ton ordinateur, accepte bien sûr.
[*]Copie/colle le rapport (c:\vundofix.txt) dans ta réponse

2-Télécharge Combofix de sUBs :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[*]Ferme toutes les fenêtres
[*]Double-clique sur combofix.exe (ne clique pas sur la fenêtre qui s'ouvre)
[*]Appuie sur Y pour lancer le scan
[*]A la fin du scan (cela peut prendre du temps), un rapport sera créé.
[*]Poste ce rapport dans ton prochain message.
1
Réponse 2 / 11
la grande dinde Messages postés 75 Statut Membre 4
 
Bonjour,
super ce log.simpa aussi le "bonjour" et le "merci" mais il faudrait peu etre exposer ton probleme plus precisement. Sinon tu risque d'attendre longtemps
0
Réponse 3 / 11
phil.douai Messages postés 13 Statut Membre
 
Re,

A chaque fois que je lance une analyse de mon antivirus (trend), il me detecte de nouveaux fichiers infectés, avec des troyants différents :
troj_vundo.zk ou troj_dloader.rky par exemple... Donc j'imagine qu'il y a moyen de les supprimer de façon radicale ??

Merci !
0
Réponse 4 / 11
la grande dinde Messages postés 75 Statut Membre 4
 
Re,
Fait un scan en ligne avec Panda
1. Passe un petit coup de Ccleaner
https://www.01net.com/
2. Toutes fenêtres (applications) fermées, hormis la connexion Internet,
fais un scan en ligne avec Panda(avec internet exploreur) :
https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/fr/activescan_principal.htm
Double-clique sur la fenêtre > Scan your pc now.
Rempli les fenêtres > Country > Province > Adresse mail (n’ importe laquelle),
puis > Free online scan (Accepte l' ActiveX si on te le demande) ...
Clique sur > My computer (ou Poste de travail).
Une fois le scan achevé, clique sur > See report, puis Save report
(Sauvegarde le rapport) et colle-le dans ta réponse.
@+
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 11
la grande dinde Messages postés 75 Statut Membre 4
 
Re,
tu peu aussi faire comme ca.
On a pas tous le meme niveau.
0
Réponse 6 / 11
phil.douai Messages postés 13 Statut Membre
 
Re,

Voici le rapport de Panda :

;***********************************************************************************************************************************************************************************
ANALYSIS: 2007-12-13 17:18:33
PROTECTIONS: 1
MALWARE: 17
SUSPECTS: 9
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Trend Micro Client-Server Security Agent 7.2 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00029434 spyware/virtumonde Spyware No 1 Yes No c:\windows\system32\ddaya.dll
00029434 spyware/virtumonde Spyware No 1 Yes No hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon\notify\ddaya
02130575 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\ddcca.dll
02130575 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\ssqrr.dll
02249699 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\ddayw.dll
02249699 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\awtsq.dll
02378188 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\rluxrlie.dll
02378188 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\fhaowlmj.dll
02378188 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\xepcmvwl.dll
02378188 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\gfmelyuj.dll
02401363 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\vtutq.dll
02526353 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\geeda.dll
02526354 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\ddcyw.dll
02526356 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\vtuts.dll
02526356 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\ssttu.dll
02526357 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\geeby.dll
02526357 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\jkkll.dll
02526357 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\mllji.dll
02526358 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\pmnnk.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\cpiifaoa.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\cseafbxc.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\ddaemtih.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\brpemjuc.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\bqehejte.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\bovckqgn.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\dfogxjou.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\dmxjyaxy.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\dseddqlb.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\epabdjlq.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\etiryeum.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\fdlxnsjp.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00EF3E0.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\fgwgkkxi.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\bojqsxsp.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\fmoqftmd.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\gbpsedgt.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\clugrabm.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\bjshrpxc.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\gfarjhlw.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\bhgsqktr.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\gkhtlkcc.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\gnvbtmqx.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\gsvgjlxe.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\hnyhvfpw.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\jbjgdcsg.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\jdkauwlk.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\cbefkmbw.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\jpjjscpu.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\bagvynet.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\kclcnrvc.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\kgvigkpd.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\lduekxdj.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\lhiorlhh.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\lhwjtias.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\lsgqooiu.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\mjsneruh.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\cnduvcws.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\mwctrgjb.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\namfmjro.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\oggxvnhd.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\oitxuhwb.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\osfkvevu.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\plvlbgii.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\bsfitcqg.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\pphcfnoj.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00DD108.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\qkghvirf.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00F77DE.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\ruboduxq.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\sewlopbj.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\sgbjahol.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\skniawhn.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\sruchkxp.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\amfufmff.dll
02646028 Adware/PurityScan Adware Yes 1 Yes No C:\WINDOWS\SYSTEM32\__C001AEF1.DAT
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00DC10F.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\tcjhvakf.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\tmxqakhr.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\tnnyteun.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\totvoycx.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00D349E.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\uevpfseg.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\upsjwbyy.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\uvujjjvh.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\uwpdlxuu.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\vnkaesnj.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\vriingvo.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\vrtycknv.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\alfcfmqa.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\afalpmvp.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\vwpomsfo.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\vxqoajaj.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\wmedwant.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\wtqnimis.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\xblgsxnj.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\jvweggdw.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\xhoglblq.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\xnyykcps.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\xpikvidp.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00CA1D9.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\xypqmogf.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\yahoardj.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\ymsmhrec.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\yogxvasc.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\yowsikhr.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\yyhbalea.dll
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00112F6.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0015734.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0017B6D.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0019B71.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c001BDF7.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c001EA6C.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0027E2E.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c002EE6D.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0032366.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c003E804.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0043640.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c004C530.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00504C4.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00548FA.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0060E8E.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00763FC.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c007919.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c007A80C.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0080376.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c008A824.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00911CD.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c0093154.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00945E6.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c009BC73.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c009D24A.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00A390D.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00A51E4.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00A6AE4.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00A945A.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00AC702.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00AD20E.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00B08B9.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00B7B2C.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00BEB81.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00C324C.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00C8927.dat
02646028 Adware/PurityScan Adware No 0 Yes No C:\WINDOWS\system32\__c00FEA9F.dat
02688352 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\xxsqisun.dll
02812101 Spyware/Vundo Spyware No 0 Yes No C:\WINDOWS\system32\tunsulem.dll
02812103 Spyware/Vundo Spyware No 0 Yes No C:\WINDOWS\system32\ffwvdrta.dll
02882933 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\aqllxdoh.dll
02884602 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\qgblrlhc.dll
02885039 Spyware/Vundo Spyware No 0 Yes No C:\WINDOWS\system32\sthxxxdl.dll
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
C:\PROGRAM FILES\ANALOG DEVICES\SOUNDMAX\SMAGENT.EXE
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
C:\PROGRAM FILES\TREND MICRO\OFFICESCAN CLIENT\NTRTSCAN.EXE
C:\PROGRAM FILES\TREND MICRO\OFFICESCAN CLIENT\PCCNTMON.EXE
C:\PROGRAM FILES\TREND MICRO\OFFICESCAN CLIENT\TMLISTEN.EXE
C:\PROGRAM FILES\ULTRAVNC\WINVNC.EXE
C:\WINDOWS\SYSTEM32\HKCMD.EXE
C:\WINDOWS\TEMP\LYC457.EXE
;===================================================================================================================================================================================
0
Réponse 7 / 11
nardino Messages postés 1634 Statut Membre 119
 
Bonsoir,
En plus de ce que je t'ai préconisé plus haut, ajoutes ceci :
Télécharge VirtumondoBegone :
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Redémarre en mode sans échec et lance VirtumundoBeGone.exe.
Et poste le rapport.

Pour supprimer Purity en mode manuel:
Tu crées un fichier fix-reg
Dans un blocnote ( Tous les programmes-Accessoires) tu copies-colles ce qui suit en gras.
Dans Format, veille à bien retirer la coche devant Retour à la ligne automatique.
Fais un retour chariot ( Entrée) après la dernière ligne.

REGEDIT4

[HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]
"ContentService"=-
[-HKEY_CURRENT_USER\software\purityscan]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddaya]

Dans Fichier, Enregistrer sous, Tous les fichiers, sur le bureau tu enregistres sous le nom fix.reg
Si le fichier obtenu est appelé fix.reg.txt, tu le renommes en supprimant .txt à la fin

Ensuite tu double-clique sur ce fichier et tu choisis Fusionner et tu acceptes.
Un message t'avertira de la bonne exécution du fix.
L'icône du fichier : https://www.118712.fr/sortir.html

Télécharge OTMoveIt :
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe
Sur ton bureau. Important.

Tu le lances, il ne nécessite pas d'installation.

Tu inscris (ou tu colles) le chemin du fichier/dossier à supprimer (C'est à dire ce qui suit)dans la fenêtre de gauche (Paste List of Files/Folders to be moved) et tu cliques sur MoveIt!.
(La case Unregister Dll's and OCX's doit être cochée.)

C:\Windows\System32\winservn.exe
c:\windows\system32\ddaya.dll
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqrr.dll
C:\WINDOWS\system32\ddayw.dll
C:\WINDOWS\system32\awtsq.dll
C:\WINDOWS\system32\rluxrlie.dll
C:\WINDOWS\system32\fhaowlmj.dll
C:\WINDOWS\system32\xepcmvwl.dll
C:\WINDOWS\system32\gfmelyuj.dll
C:\WINDOWS\system32\vtutq.dll
C:\WINDOWS\system32\geeda.dll
C:\WINDOWS\system32\ddcyw.dll
C:\WINDOWS\system32\vtuts.dll
C:\WINDOWS\system32\ssttu.dll
C:\WINDOWS\system32\geeby.dll
C:\WINDOWS\system32\jkkll.dll
C:\WINDOWS\system32\mllji.dll
C:\WINDOWS\system32\pmnnk.dll
C:\WINDOWS\system32\cpiifaoa.dll
C:\WINDOWS\system32\cseafbxc.dll
C:\WINDOWS\system32\ddaemtih.dll
C:\WINDOWS\system32\brpemjuc.dll
C:\WINDOWS\system32\bqehejte.dll
C:\WINDOWS\system32\bovckqgn.dll
C:\WINDOWS\system32\dfogxjou.dll
C:\WINDOWS\system32\dmxjyaxy.dll
C:\WINDOWS\system32\dseddqlb.dll
C:\WINDOWS\system32\epabdjlq.dll
C:\WINDOWS\system32\etiryeum.dll
C:\WINDOWS\system32\fdlxnsjp.dll
C:\WINDOWS\system32\__c00EF3E0.dat
C:\WINDOWS\system32\fgwgkkxi.dll
C:\WINDOWS\system32\bojqsxsp.dll
C:\WINDOWS\system32\fmoqftmd.dll
C:\WINDOWS\system32\gbpsedgt.dll
C:\WINDOWS\system32\clugrabm.dll
C:\WINDOWS\system32\bjshrpxc.dll
C:\WINDOWS\system32\gfarjhlw.dll
C:\WINDOWS\system32\bhgsqktr.dll
C:\WINDOWS\system32\gkhtlkcc.dll
C:\WINDOWS\system32\gnvbtmqx.dll
C:\WINDOWS\system32\gsvgjlxe.dll
C:\WINDOWS\system32\hnyhvfpw.dll
C:\WINDOWS\system32\jbjgdcsg.dll
C:\WINDOWS\system32\jdkauwlk.dll
C:\WINDOWS\system32\cbefkmbw.dll
C:\WINDOWS\system32\jpjjscpu.dll
C:\WINDOWS\system32\bagvynet.dll
C:\WINDOWS\system32\kclcnrvc.dll
C:\WINDOWS\system32\kgvigkpd.dll
C:\WINDOWS\system32\lduekxdj.dll
C:\WINDOWS\system32\lhiorlhh.dll
C:\WINDOWS\system32\lhwjtias.dll
C:\WINDOWS\system32\lsgqooiu.dll
C:\WINDOWS\system32\mjsneruh.dll
C:\WINDOWS\system32\cnduvcws.dll
C:\WINDOWS\system32\mwctrgjb.dll
C:\WINDOWS\system32\namfmjro.dll
C:\WINDOWS\system32\oggxvnhd.dll
C:\WINDOWS\system32\oitxuhwb.dll
C:\WINDOWS\system32\osfkvevu.dll
C:\WINDOWS\system32\plvlbgii.dll
C:\WINDOWS\system32\bsfitcqg.dll
C:\WINDOWS\system32\pphcfnoj.dll
C:\WINDOWS\system32\__c00DD108.dat
C:\WINDOWS\system32\qkghvirf.dll
C:\WINDOWS\system32\__c00F77DE.dat
C:\WINDOWS\system32\ruboduxq.dll
C:\WINDOWS\system32\sewlopbj.dll
C:\WINDOWS\system32\sgbjahol.dll
C:\WINDOWS\system32\skniawhn.dll
C:\WINDOWS\system32\sruchkxp.dll
C:\WINDOWS\system32\amfufmff.dll
C:\WINDOWS\SYSTEM32\__C001AEF1.DAT
C:\WINDOWS\system32\__c00DC10F.dat
C:\WINDOWS\system32\tcjhvakf.dll
C:\WINDOWS\system32\tmxqakhr.dll
C:\WINDOWS\system32\tnnyteun.dll
C:\WINDOWS\system32\totvoycx.dll
C:\WINDOWS\system32\__c00D349E.dat
C:\WINDOWS\system32\uevpfseg.dll
C:\WINDOWS\system32\upsjwbyy.dll
C:\WINDOWS\system32\uvujjjvh.dll
C:\WINDOWS\system32\uwpdlxuu.dll
C:\WINDOWS\system32\vnkaesnj.dll
C:\WINDOWS\system32\vriingvo.dll
C:\WINDOWS\system32\vrtycknv.dll
C:\WINDOWS\system32\alfcfmqa.dll
C:\WINDOWS\system32\afalpmvp.dll
C:\WINDOWS\system32\vwpomsfo.dll
C:\WINDOWS\system32\vxqoajaj.dll
C:\WINDOWS\system32\wmedwant.dll
C:\WINDOWS\system32\wtqnimis.dll
C:\WINDOWS\system32\xblgsxnj.dll
C:\WINDOWS\system32\jvweggdw.dll
C:\WINDOWS\system32\xhoglblq.dll
C:\WINDOWS\system32\xnyykcps.dll
C:\WINDOWS\system32\xpikvidp.dll
C:\WINDOWS\system32\__c00CA1D9.dat
C:\WINDOWS\system32\xypqmogf.dll
C:\WINDOWS\system32\yahoardj.dll
C:\WINDOWS\system32\ymsmhrec.dll
C:\WINDOWS\system32\yogxvasc.dll
C:\WINDOWS\system32\yowsikhr.dll
C:\WINDOWS\system32\yyhbalea.dll
C:\WINDOWS\system32\__c00112F6.dat
C:\WINDOWS\system32\__c0015734.dat
C:\WINDOWS\system32\__c0017B6D.dat
C:\WINDOWS\system32\__c0019B71.dat
C:\WINDOWS\system32\__c001BDF7.dat
C:\WINDOWS\system32\__c001EA6C.dat
C:\WINDOWS\system32\__c0027E2E.dat
C:\WINDOWS\system32\__c002EE6D.dat
C:\WINDOWS\system32\__c0032366.dat
C:\WINDOWS\system32\__c003E804.dat
C:\WINDOWS\system32\__c0043640.dat
C:\WINDOWS\system32\__c004C530.dat
C:\WINDOWS\system32\__c00504C4.dat
C:\WINDOWS\system32\__c00548FA.dat
C:\WINDOWS\system32\__c0060E8E.dat
C:\WINDOWS\system32\__c00763FC.dat
C:\WINDOWS\system32\__c007919.dat
C:\WINDOWS\system32\__c007A80C.dat
C:\WINDOWS\system32\__c0080376.dat
C:\WINDOWS\system32\__c008A824.dat
C:\WINDOWS\system32\__c00911CD.dat
C:\WINDOWS\system32\__c0093154.dat
C:\WINDOWS\system32\__c00945E6.dat
C:\WINDOWS\system32\__c009BC73.dat
C:\WINDOWS\system32\__c009D24A.dat
C:\WINDOWS\system32\__c00A390D.dat
C:\WINDOWS\system32\__c00A51E4.dat
C:\WINDOWS\system32\__c00A6AE4.dat
C:\WINDOWS\system32\__c00A945A.dat
C:\WINDOWS\system32\__c00AC702.dat
C:\WINDOWS\system32\__c00AD20E.dat
C:\WINDOWS\system32\__c00B08B9.dat
C:\WINDOWS\system32\__c00B7B2C.dat
C:\WINDOWS\system32\__c00BEB81.dat
C:\WINDOWS\system32\__c00C324C.dat
C:\WINDOWS\system32\__c00C8927.dat
C:\WINDOWS\system32\__c00FEA9F.dat
C:\WINDOWS\system32\xxsqisun.dll
C:\WINDOWS\system32\ffwvdrta.dll
C:\WINDOWS\system32\qgblrlhc.dll
C:\WINDOWS\system32\sthxxxdl.dll


Le fichier passe alors dans la fenêtre de droite.
Et tu obtiendras à la racine du système un dossier C:\_OTMoveIt
Dans ce dernier un sous-dossier Moved Files dans lequel il y aura une sauvegarde du/des fichier(s) supprimé(s) et un fichier de ce type
********_******.log (mm/jj/aaaa_hh/mm/ss = date et horaire de la suppression).
Tu le posteras par copier-coller pour contrôle.

Si un redémarrage est demandé, accepte-le après avoir fermé tes applications en cours et terminé la procédure.

Et pour finir dans : C:\Program Files
Tu supprimes le dossier Purity Scan en totalité.
0
Réponse 8 / 11
phil.douai Messages postés 13 Statut Membre
 
Bonjour,

J'ai effectué les maips, voici les rapports :

VUNDOFIX :

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 08:09:36 14/12/2007

Listing files found while scanning....

C:\windows\system32\__c00112F6.dat
C:\windows\system32\__c0015734.dat
C:\windows\system32\__c0017B6D.dat
C:\windows\system32\__c0019B71.dat
C:\windows\system32\__c001AEF1.dat
C:\windows\system32\__c001BDF7.dat
C:\windows\system32\__c001EA6C.dat
C:\windows\system32\__c0027E2E.dat
C:\windows\system32\__c002EE6D.dat
C:\windows\system32\__c0032366.dat
C:\windows\system32\__c003E804.dat
C:\windows\system32\__c0043640.dat
C:\windows\system32\__c004C530.dat
C:\windows\system32\__c00504C4.dat
C:\windows\system32\__c00548FA.dat
C:\windows\system32\__c0060E8E.dat
C:\windows\system32\__c00763FC.dat
C:\windows\system32\__c007919.dat
C:\windows\system32\__c007A80C.dat
C:\windows\system32\__c0080376.dat
C:\windows\system32\__c008A824.dat
C:\windows\system32\__c00911CD.dat
C:\windows\system32\__c0093154.dat
C:\windows\system32\__c00945E6.dat
C:\windows\system32\__c009BC73.dat
C:\windows\system32\__c009D24A.dat
C:\windows\system32\__c00A390D.dat
C:\windows\system32\__c00A51E4.dat
C:\windows\system32\__c00A6AE4.dat
C:\windows\system32\__c00A945A.dat
C:\windows\system32\__c00AC702.dat
C:\windows\system32\__c00AD20E.dat
C:\windows\system32\__c00B08B9.dat
C:\windows\system32\__c00B7B2C.dat
C:\windows\system32\__c00BEB81.dat
C:\windows\system32\__c00C324C.dat
C:\windows\system32\__c00C8927.dat
C:\windows\system32\__c00CA1D9.dat
C:\windows\system32\__c00D349E.dat
C:\windows\system32\__c00DC10F.dat
C:\windows\system32\__c00DD108.dat
C:\windows\system32\__c00EF3E0.dat
C:\windows\system32\__c00F77DE.dat
C:\windows\system32\__c00FEA9F.dat
C:\windows\system32\afalpmvp.dll
C:\windows\system32\alfcfmqa.dll
C:\windows\system32\amfufmff.dll
C:\windows\system32\bagvynet.dll
C:\windows\system32\bhgsqktr.dll
C:\windows\system32\bjshrpxc.dll
C:\windows\system32\bojqsxsp.dll
C:\windows\system32\bovckqgn.dll
C:\windows\system32\bqehejte.dll
C:\windows\system32\brpemjuc.dll
C:\windows\system32\bsfitcqg.dll
C:\windows\system32\cbefkmbw.dll
C:\windows\system32\clugrabm.dll
C:\windows\system32\cnduvcws.dll
C:\windows\system32\cpiifaoa.dll
C:\windows\system32\cseafbxc.dll
C:\windows\system32\ddaemtih.dll
C:\windows\system32\dfogxjou.dll
C:\windows\system32\dmxjyaxy.dll
C:\windows\system32\dseddqlb.dll
C:\windows\system32\epabdjlq.dll
C:\windows\system32\etiryeum.dll
C:\windows\system32\fdlxnsjp.dll
C:\windows\system32\fgwgkkxi.dll
C:\windows\system32\fmoqftmd.dll
C:\windows\system32\gbpsedgt.dll
C:\windows\system32\gfarjhlw.dll
C:\windows\system32\gkhtlkcc.dll
C:\windows\system32\gnvbtmqx.dll
C:\windows\system32\gsvgjlxe.dll
C:\windows\system32\hnyhvfpw.dll
C:\windows\system32\jbjgdcsg.dll
C:\windows\system32\jdkauwlk.dll
C:\windows\system32\jpjjscpu.dll
C:\windows\system32\jvweggdw.dll
C:\windows\system32\kclcnrvc.dll
C:\windows\system32\kgvigkpd.dll
C:\windows\system32\lduekxdj.dll
C:\windows\system32\lhiorlhh.dll
C:\windows\system32\lhwjtias.dll
C:\windows\system32\lsgqooiu.dll
C:\windows\system32\mjsneruh.dll
C:\windows\system32\mwctrgjb.dll
C:\windows\system32\namfmjro.dll
C:\windows\system32\oggxvnhd.dll
C:\windows\system32\oitxuhwb.dll
C:\windows\system32\osfkvevu.dll
C:\windows\system32\plvlbgii.dll
C:\windows\system32\pphcfnoj.dll
C:\windows\system32\prybxyjt.dll
C:\windows\system32\qkghvirf.dll
C:\WINDOWS\system32\qtutv.bak1
C:\WINDOWS\system32\qtutv.bak2
C:\WINDOWS\system32\qtutv.ini
C:\windows\system32\ruboduxq.dll
C:\windows\system32\sewlopbj.dll
C:\windows\system32\sgbjahol.dll
C:\windows\system32\skniawhn.dll
C:\windows\system32\sruchkxp.dll
C:\windows\system32\tcjhvakf.dll
C:\windows\system32\tmxqakhr.dll
C:\windows\system32\tnnyteun.dll
C:\windows\system32\totvoycx.dll
C:\windows\system32\uevpfseg.dll
C:\windows\system32\upsjwbyy.dll
C:\windows\system32\uvujjjvh.dll
C:\windows\system32\uwpdlxuu.dll
C:\windows\system32\vnkaesnj.dll
C:\windows\system32\vriingvo.dll
C:\windows\system32\vrtycknv.dll
C:\WINDOWS\system32\vtutq.dll
C:\windows\system32\vwpomsfo.dll
C:\windows\system32\vxqoajaj.dll
C:\windows\system32\wmedwant.dll
C:\windows\system32\wtqnimis.dll
C:\windows\system32\xblgsxnj.dll
C:\windows\system32\xhoglblq.dll
C:\windows\system32\xnyykcps.dll
C:\windows\system32\xpikvidp.dll
C:\windows\system32\xypqmogf.dll
C:\windows\system32\yahoardj.dll
C:\windows\system32\ymsmhrec.dll
C:\windows\system32\yogxvasc.dll
C:\windows\system32\yowsikhr.dll
C:\windows\system32\yyhbalea.dll

Beginning removal...

Attempting to delete C:\windows\system32\__c00112F6.dat
C:\windows\system32\__c00112F6.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0015734.dat
C:\windows\system32\__c0015734.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0017B6D.dat
C:\windows\system32\__c0017B6D.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0019B71.dat
C:\windows\system32\__c0019B71.dat Has been deleted!

Attempting to delete C:\windows\system32\__c001AEF1.dat
C:\windows\system32\__c001AEF1.dat Could not be deleted.

Attempting to delete C:\windows\system32\__c001BDF7.dat
C:\windows\system32\__c001BDF7.dat Has been deleted!

Attempting to delete C:\windows\system32\__c001EA6C.dat
C:\windows\system32\__c001EA6C.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0027E2E.dat
C:\windows\system32\__c0027E2E.dat Has been deleted!

Attempting to delete C:\windows\system32\__c002EE6D.dat
C:\windows\system32\__c002EE6D.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0032366.dat
C:\windows\system32\__c0032366.dat Has been deleted!

Attempting to delete C:\windows\system32\__c003E804.dat
C:\windows\system32\__c003E804.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0043640.dat
C:\windows\system32\__c0043640.dat Has been deleted!

Attempting to delete C:\windows\system32\__c004C530.dat
C:\windows\system32\__c004C530.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00504C4.dat
C:\windows\system32\__c00504C4.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00548FA.dat
C:\windows\system32\__c00548FA.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0060E8E.dat
C:\windows\system32\__c0060E8E.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00763FC.dat
C:\windows\system32\__c00763FC.dat Has been deleted!

Attempting to delete C:\windows\system32\__c007919.dat
C:\windows\system32\__c007919.dat Has been deleted!

Attempting to delete C:\windows\system32\__c007A80C.dat
C:\windows\system32\__c007A80C.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0080376.dat
C:\windows\system32\__c0080376.dat Has been deleted!

Attempting to delete C:\windows\system32\__c008A824.dat
C:\windows\system32\__c008A824.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00911CD.dat
C:\windows\system32\__c00911CD.dat Has been deleted!

Attempting to delete C:\windows\system32\__c0093154.dat
C:\windows\system32\__c0093154.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00945E6.dat
C:\windows\system32\__c00945E6.dat Has been deleted!

Attempting to delete C:\windows\system32\__c009BC73.dat
C:\windows\system32\__c009BC73.dat Has been deleted!

Attempting to delete C:\windows\system32\__c009D24A.dat
C:\windows\system32\__c009D24A.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00A390D.dat
C:\windows\system32\__c00A390D.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00A51E4.dat
C:\windows\system32\__c00A51E4.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00A6AE4.dat
C:\windows\system32\__c00A6AE4.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00A945A.dat
C:\windows\system32\__c00A945A.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00AC702.dat
C:\windows\system32\__c00AC702.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00AD20E.dat
C:\windows\system32\__c00AD20E.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00B08B9.dat
C:\windows\system32\__c00B08B9.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00B7B2C.dat
C:\windows\system32\__c00B7B2C.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00BEB81.dat
C:\windows\system32\__c00BEB81.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00C324C.dat
C:\windows\system32\__c00C324C.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00C8927.dat
C:\windows\system32\__c00C8927.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00CA1D9.dat
C:\windows\system32\__c00CA1D9.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00D349E.dat
C:\windows\system32\__c00D349E.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00DC10F.dat
C:\windows\system32\__c00DC10F.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00DD108.dat
C:\windows\system32\__c00DD108.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00EF3E0.dat
C:\windows\system32\__c00EF3E0.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00F77DE.dat
C:\windows\system32\__c00F77DE.dat Has been deleted!

Attempting to delete C:\windows\system32\__c00FEA9F.dat
C:\windows\system32\__c00FEA9F.dat Has been deleted!

Attempting to delete C:\windows\system32\afalpmvp.dll
C:\windows\system32\afalpmvp.dll Has been deleted!

Attempting to delete C:\windows\system32\alfcfmqa.dll
C:\windows\system32\alfcfmqa.dll Has been deleted!

Attempting to delete C:\windows\system32\amfufmff.dll
C:\windows\system32\amfufmff.dll Has been deleted!

Attempting to delete C:\windows\system32\bagvynet.dll
C:\windows\system32\bagvynet.dll Has been deleted!

Attempting to delete C:\windows\system32\bhgsqktr.dll
C:\windows\system32\bhgsqktr.dll Has been deleted!

Attempting to delete C:\windows\system32\bjshrpxc.dll
C:\windows\system32\bjshrpxc.dll Has been deleted!

Attempting to delete C:\windows\system32\bojqsxsp.dll
C:\windows\system32\bojqsxsp.dll Has been deleted!

Attempting to delete C:\windows\system32\bovckqgn.dll
C:\windows\system32\bovckqgn.dll Has been deleted!

Attempting to delete C:\windows\system32\bqehejte.dll
C:\windows\system32\bqehejte.dll Has been deleted!

Attempting to delete C:\windows\system32\brpemjuc.dll
C:\windows\system32\brpemjuc.dll Has been deleted!

Attempting to delete C:\windows\system32\bsfitcqg.dll
C:\windows\system32\bsfitcqg.dll Has been deleted!

Attempting to delete C:\windows\system32\cbefkmbw.dll
C:\windows\system32\cbefkmbw.dll Has been deleted!

Attempting to delete C:\windows\system32\clugrabm.dll
C:\windows\system32\clugrabm.dll Has been deleted!

Attempting to delete C:\windows\system32\cnduvcws.dll
C:\windows\system32\cnduvcws.dll Has been deleted!

Attempting to delete C:\windows\system32\cpiifaoa.dll
C:\windows\system32\cpiifaoa.dll Has been deleted!

Attempting to delete C:\windows\system32\cseafbxc.dll
C:\windows\system32\cseafbxc.dll Has been deleted!

Attempting to delete C:\windows\system32\ddaemtih.dll
C:\windows\system32\ddaemtih.dll Has been deleted!

Attempting to delete C:\windows\system32\dfogxjou.dll
C:\windows\system32\dfogxjou.dll Has been deleted!

Attempting to delete C:\windows\system32\dmxjyaxy.dll
C:\windows\system32\dmxjyaxy.dll Has been deleted!

Attempting to delete C:\windows\system32\dseddqlb.dll
C:\windows\system32\dseddqlb.dll Has been deleted!

Attempting to delete C:\windows\system32\epabdjlq.dll
C:\windows\system32\epabdjlq.dll Has been deleted!

Attempting to delete C:\windows\system32\etiryeum.dll
C:\windows\system32\etiryeum.dll Has been deleted!

Attempting to delete C:\windows\system32\fdlxnsjp.dll
C:\windows\system32\fdlxnsjp.dll Has been deleted!

Attempting to delete C:\windows\system32\fgwgkkxi.dll
C:\windows\system32\fgwgkkxi.dll Has been deleted!

Attempting to delete C:\windows\system32\fmoqftmd.dll
C:\windows\system32\fmoqftmd.dll Has been deleted!

Attempting to delete C:\windows\system32\gbpsedgt.dll
C:\windows\system32\gbpsedgt.dll Has been deleted!

Attempting to delete C:\windows\system32\gfarjhlw.dll
C:\windows\system32\gfarjhlw.dll Has been deleted!

Attempting to delete C:\windows\system32\gkhtlkcc.dll
C:\windows\system32\gkhtlkcc.dll Has been deleted!

Attempting to delete C:\windows\system32\gnvbtmqx.dll
C:\windows\system32\gnvbtmqx.dll Has been deleted!

Attempting to delete C:\windows\system32\gsvgjlxe.dll
C:\windows\system32\gsvgjlxe.dll Has been deleted!

Attempting to delete C:\windows\system32\hnyhvfpw.dll
C:\windows\system32\hnyhvfpw.dll Has been deleted!

Attempting to delete C:\windows\system32\jbjgdcsg.dll
C:\windows\system32\jbjgdcsg.dll Has been deleted!

Attempting to delete C:\windows\system32\jdkauwlk.dll
C:\windows\system32\jdkauwlk.dll Has been deleted!

Attempting to delete C:\windows\system32\jpjjscpu.dll
C:\windows\system32\jpjjscpu.dll Has been deleted!

Attempting to delete C:\windows\system32\jvweggdw.dll
C:\windows\system32\jvweggdw.dll Has been deleted!

Attempting to delete C:\windows\system32\kclcnrvc.dll
C:\windows\system32\kclcnrvc.dll Has been deleted!

Attempting to delete C:\windows\system32\kgvigkpd.dll
C:\windows\system32\kgvigkpd.dll Has been deleted!

Attempting to delete C:\windows\system32\lduekxdj.dll
C:\windows\system32\lduekxdj.dll Has been deleted!

Attempting to delete C:\windows\system32\lhiorlhh.dll
C:\windows\system32\lhiorlhh.dll Has been deleted!

Attempting to delete C:\windows\system32\lhwjtias.dll
C:\windows\system32\lhwjtias.dll Has been deleted!

Attempting to delete C:\windows\system32\lsgqooiu.dll
C:\windows\system32\lsgqooiu.dll Has been deleted!

Attempting to delete C:\windows\system32\mjsneruh.dll
C:\windows\system32\mjsneruh.dll Has been deleted!

Attempting to delete C:\windows\system32\mwctrgjb.dll
C:\windows\system32\mwctrgjb.dll Has been deleted!

Attempting to delete C:\windows\system32\namfmjro.dll
C:\windows\system32\namfmjro.dll Has been deleted!

Attempting to delete C:\windows\system32\oggxvnhd.dll
C:\windows\system32\oggxvnhd.dll Has been deleted!

Attempting to delete C:\windows\system32\oitxuhwb.dll
C:\windows\system32\oitxuhwb.dll Has been deleted!

Attempting to delete C:\windows\system32\osfkvevu.dll
C:\windows\system32\osfkvevu.dll Has been deleted!

Attempting to delete C:\windows\system32\plvlbgii.dll
C:\windows\system32\plvlbgii.dll Has been deleted!

Attempting to delete C:\windows\system32\pphcfnoj.dll
C:\windows\system32\pphcfnoj.dll Has been deleted!

Attempting to delete C:\windows\system32\prybxyjt.dll
C:\windows\system32\prybxyjt.dll Has been deleted!

Attempting to delete C:\windows\system32\qkghvirf.dll
C:\windows\system32\qkghvirf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtutv.bak1
C:\WINDOWS\system32\qtutv.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtutv.bak2
C:\WINDOWS\system32\qtutv.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtutv.ini
C:\WINDOWS\system32\qtutv.ini Has been deleted!

Attempting to delete C:\windows\system32\ruboduxq.dll
C:\windows\system32\ruboduxq.dll Has been deleted!

Attempting to delete C:\windows\system32\sewlopbj.dll
C:\windows\system32\sewlopbj.dll Has been deleted!

Attempting to delete C:\windows\system32\sgbjahol.dll
C:\windows\system32\sgbjahol.dll Has been deleted!

Attempting to delete C:\windows\system32\skniawhn.dll
C:\windows\system32\skniawhn.dll Has been deleted!

Attempting to delete C:\windows\system32\sruchkxp.dll
C:\windows\system32\sruchkxp.dll Has been deleted!

Attempting to delete C:\windows\system32\tcjhvakf.dll
C:\windows\system32\tcjhvakf.dll Has been deleted!

Attempting to delete C:\windows\system32\tmxqakhr.dll
C:\windows\system32\tmxqakhr.dll Has been deleted!

Attempting to delete C:\windows\system32\tnnyteun.dll
C:\windows\system32\tnnyteun.dll Has been deleted!

Attempting to delete C:\windows\system32\totvoycx.dll
C:\windows\system32\totvoycx.dll Has been deleted!

Attempting to delete C:\windows\system32\uevpfseg.dll
C:\windows\system32\uevpfseg.dll Has been deleted!

Attempting to delete C:\windows\system32\upsjwbyy.dll
C:\windows\system32\upsjwbyy.dll Has been deleted!

Attempting to delete C:\windows\system32\uvujjjvh.dll
C:\windows\system32\uvujjjvh.dll Has been deleted!

Attempting to delete C:\windows\system32\uwpdlxuu.dll
C:\windows\system32\uwpdlxuu.dll Has been deleted!

Attempting to delete C:\windows\system32\vnkaesnj.dll
C:\windows\system32\vnkaesnj.dll Has been deleted!

Attempting to delete C:\windows\system32\vriingvo.dll
C:\windows\system32\vriingvo.dll Has been deleted!

Attempting to delete C:\windows\system32\vrtycknv.dll
C:\windows\system32\vrtycknv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vtutq.dll
C:\WINDOWS\system32\vtutq.dll Has been deleted!

Attempting to delete C:\windows\system32\vwpomsfo.dll
C:\windows\system32\vwpomsfo.dll Has been deleted!

Attempting to delete C:\windows\system32\vxqoajaj.dll
C:\windows\system32\vxqoajaj.dll Has been deleted!

Attempting to delete C:\windows\system32\wmedwant.dll
C:\windows\system32\wmedwant.dll Has been deleted!

Attempting to delete C:\windows\system32\wtqnimis.dll
C:\windows\system32\wtqnimis.dll Has been deleted!

Attempting to delete C:\windows\system32\xblgsxnj.dll
C:\windows\system32\xblgsxnj.dll Has been deleted!

Attempting to delete C:\windows\system32\xhoglblq.dll
C:\windows\system32\xhoglblq.dll Has been deleted!

Attempting to delete C:\windows\system32\xnyykcps.dll
C:\windows\system32\xnyykcps.dll Has been deleted!

Attempting to delete C:\windows\system32\xpikvidp.dll
C:\windows\system32\xpikvidp.dll Has been deleted!

Attempting to delete C:\windows\system32\xypqmogf.dll
C:\windows\system32\xypqmogf.dll Has been deleted!

Attempting to delete C:\windows\system32\yahoardj.dll
C:\windows\system32\yahoardj.dll Has been deleted!

Attempting to delete C:\windows\system32\ymsmhrec.dll
C:\windows\system32\ymsmhrec.dll Has been deleted!

Attempting to delete C:\windows\system32\yogxvasc.dll
C:\windows\system32\yogxvasc.dll Has been deleted!

Attempting to delete C:\windows\system32\yowsikhr.dll
C:\windows\system32\yowsikhr.dll Has been deleted!

Attempting to delete C:\windows\system32\yyhbalea.dll
C:\windows\system32\yyhbalea.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

COMBOFIX :
Il y a eu plusieurs étapes puis une fenêtre "Deleting files/folders". Pas d'autres messages, j'ai rebooté le pc

ComboFix 07-12-14.4 - dducoulombier 2007-12-14 8:48:34.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.163 [GMT 1:00]
Running from: C:\sav\ComboFix.exe

VIRTUMUNDOBEGONE :

[12/14/2007, 9:15:00] - VirtumundoBeGone v1.5 ( "C:\sav\VirtumundoBeGone.exe" )
[12/14/2007, 9:15:07] - Detected System Information:
[12/14/2007, 9:15:07] - Windows Version: 5.1.2600, Service Pack 2
[12/14/2007, 9:15:07] - Current Username: dducoulombier (Admin)
[12/14/2007, 9:15:07] - Windows is in SAFE mode.
[12/14/2007, 9:15:07] - Searching for Browser Helper Objects:
[12/14/2007, 9:15:07] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[12/14/2007, 9:15:07] - BHO 2: {6278f958-05b5-4c02-a6de-eba91417fb32} ()
[12/14/2007, 9:15:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/14/2007, 9:15:07] - Checking for HKLM\...\Winlogon\Notify\aifkfolo
[12/14/2007, 9:15:07] - Key not found: HKLM\...\Winlogon\Notify\aifkfolo, continuing.
[12/14/2007, 9:15:07] - BHO 3: {77058708-B23F-44D1-BD3A-890D226ABA3C} ()
[12/14/2007, 9:15:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/14/2007, 9:15:07] - Checking for HKLM\...\Winlogon\Notify\sstqp
[12/14/2007, 9:15:07] - Key not found: HKLM\...\Winlogon\Notify\sstqp, continuing.
[12/14/2007, 9:15:07] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[12/14/2007, 9:15:07] - Finished Searching Browser Helper Objects
[12/14/2007, 9:15:07] - Finishing up...
[12/14/2007, 9:15:07] - Nothing found! Exiting...

J'ai aussi supprimé Purity.

A bientôt pour la suite !

.
0
Réponse 9 / 11
nardino Messages postés 1634 Statut Membre 119
 
Bonsoir.

Rencontres-tu encore des problèmes ?
Si oui lesquels ?
0
Réponse 10 / 11
phil.douai Messages postés 13 Statut Membre
 
Bonjour,

Non, plus de pb ! Merci encore !
0
Réponse 11 / 11
nardino Messages postés 1634 Statut Membre 119
 
Bonjour,

Supprimes Vundofix, Virtumonde, Combofix et les rapports établis par ces outils ainsi que le fichier fix.reg.
Il faut procéder à la mise à jour du programme suivant :

-Java Runtime Environment (JRE)6u3 :
https://www.oracle.com/java/technologies/javase-downloads.html
Clique sur Download Java Runtime Environment (JRE) 6u3
Dans la page suivante coche [b]Iaccept[/b] et télécharge [b] Windows Offline Installation, Multi-language //jre-6u3-windows-i586-p.exe //13.89 MB[/b]
Tu l'installeras hors connexion.
Dans Ajout/Suppression des programmes tu supprimes toutes les autres versions.
Dans Démarrer, tape appwiz.cpl, puis Entrée et supprime toutes les autres versions.
0

Discussions similaires

Checking media presence… media present
Jeanpierre67 -
SATS_fr -

2 réponses
affichage checking media
titi__5106 -
jfmimi -

5 réponses
Check media fail
PandaGracieux25 -
brucine -

5 réponses
Start px over IPv4
Colygoods -
Len -

4 réponses
Reseaux sociaux
ChiotCharmant90 -
MPMP10 -

1 réponse