Présence de troyans... help, merci ! Résolu/Fermé

Question

Bonjour,

Je vous joint le rapport hijackthis... MERCI !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:11:47, on 13/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\LYC457.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\spyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/040C/bl8.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/040C/bl7.asp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/040C/bl7.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Imprimante GedExpertPDF.lnk = C:\Program Files\AWAZUR\AWClientSQL\AWMonitor.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {F11BFF96-CC7A-4482-819B-91EAE4C454EF} (NTR ActiveX 1.1.6) - http://www.inquiero.com/inquiero/mod/setup/ntractivex116_14.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fidexpert.fidexpert.fr
O17 - HKLM\Software\..\Telephony: DomainName = fidexpert.fidexpert.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{4913F47C-2946-48A2-AF9C-84086BBCB134}: NameServer = 194.2.0.20,194.2.0.50
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fidexpert.fidexpert.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{4913F47C-2946-48A2-AF9C-84086BBCB134}: NameServer = 194.2.0.20,194.2.0.50
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fidexpert.fidexpert.fr
O17 - HKLM\System\CS2\Services\Tcpip\..\{4913F47C-2946-48A2-AF9C-84086BBCB134}: NameServer = 194.2.0.20,194.2.0.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c001AEF1.dat
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Scan en temps réel Trend Micro Client/Server Security Agent (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe
O23 - Service: Pare-feu personnel Trend Micro Client/Server Security Agent (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend Micro Client-Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

la grande dinde · Answer

Bonjour,
super ce log.simpa aussi le "bonjour" et le "merci" mais il faudrait peu etre exposer ton probleme plus precisement. Sinon tu risque d'attendre longtemps

phil.douai · Answer

Re,

A chaque fois que je lance une analyse de mon antivirus (trend), il me detecte de nouveaux fichiers infectés, avec des troyants différents :
troj_vundo.zk ou troj_dloader.rky par exemple... Donc j'imagine qu'il y a moyen de les supprimer de façon radicale ??

Merci !

la grande dinde · Answer

Re,
Fait un scan en ligne avec Panda
1. Passe un petit coup de Ccleaner
https://www.01net.com/
2. Toutes fenêtres (applications) fermées, hormis la connexion Internet,
fais un scan en ligne avec Panda(avec internet exploreur) :
https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/fr/activescan_principal.htm
Double-clique sur la fenêtre > Scan your pc now.
Rempli les fenêtres > Country > Province > Adresse mail (n’ importe laquelle),
puis > Free online scan (Accepte l' ActiveX si on te le demande) ...
Clique sur > My computer (ou Poste de travail).
Une fois le scan achevé, clique sur > See report, puis Save report
(Sauvegarde le rapport) et colle-le dans ta réponse.
@+

nardino · Answer

Bonjour.
1-Télécharge VundoFix de Atribune : 
http://www.atribune.org/ccount/click.php?id=4

	[*]Double clic sur Vundofix.exe.
	[*]Coche la case Run VundoFix as a task
	[*]Répond OK au popup qui s'ouvre.
Il va se refermer et réouvrir au bout d'une minute environ.
	[*]Quand il est rouvert, clique sur Scan for Vundo
	[*]Quand le scan est terminé, clique sur Remove Vundo
	[*]Réponds Yes à la demande de suppression des fichiers.
	[*]Il te sera demandé de redémarrer ton ordinateur, accepte bien sûr.
	[*]Copie/colle le rapport (c:\vundofix.txt) dans ta réponse

2-Télécharge Combofix de sUBs : 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

	[*]Ferme toutes les fenêtres
	[*]Double-clique sur combofix.exe (ne clique pas sur la fenêtre qui s'ouvre)
	[*]Appuie sur Y pour lancer le scan
	[*]A la fin du scan (cela peut prendre du temps), un rapport sera créé.
	[*]Poste ce rapport dans ton prochain message.

la grande dinde · Answer

Re,
tu peu aussi faire comme ca. 
On a pas tous le meme niveau.

phil.douai · Answer

Re,

Voici le rapport de Panda :



;***********************************************************************************************************************************************************************************
ANALYSIS: 2007-12-13 17:18:33
PROTECTIONS: 1
MALWARE: 17
SUSPECTS: 9
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Trend Micro Client-Server Security Agent     7.2                           Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00029434  spyware/virtumonde                 Spyware             No        1         Yes            No           c:\windows\system32\ddaya.dll
00029434  spyware/virtumonde                 Spyware             No        1         Yes            No           hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon
otify\ddaya
02130575  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\ddcca.dll
02130575  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\ssqrr.dll
02249699  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\ddayw.dll
02249699  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\awtsq.dll
02378188  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32luxrlie.dll
02378188  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\fhaowlmj.dll
02378188  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\xepcmvwl.dll
02378188  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\gfmelyuj.dll
02401363  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\vtutq.dll
02526353  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\geeda.dll
02526354  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\ddcyw.dll
02526356  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\vtuts.dll
02526356  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\ssttu.dll
02526357  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\geeby.dll
02526357  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\jkkll.dll
02526357  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\mllji.dll
02526358  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\pmnnk.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\cpiifaoa.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\cseafbxc.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\ddaemtih.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\brpemjuc.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\bqehejte.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\bovckqgn.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\dfogxjou.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\dmxjyaxy.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\dseddqlb.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\epabdjlq.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\etiryeum.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\fdlxnsjp.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00EF3E0.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\fgwgkkxi.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\bojqsxsp.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\fmoqftmd.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\gbpsedgt.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\clugrabm.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\bjshrpxc.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\gfarjhlw.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\bhgsqktr.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\gkhtlkcc.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\gnvbtmqx.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\gsvgjlxe.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\hnyhvfpw.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\jbjgdcsg.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\jdkauwlk.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\cbefkmbw.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\jpjjscpu.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\bagvynet.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\kclcnrvc.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\kgvigkpd.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\lduekxdj.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\lhiorlhh.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\lhwjtias.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\lsgqooiu.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\mjsneruh.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\cnduvcws.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\mwctrgjb.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32
amfmjro.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\oggxvnhd.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\oitxuhwb.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\osfkvevu.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\plvlbgii.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\bsfitcqg.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\pphcfnoj.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00DD108.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\qkghvirf.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00F77DE.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32uboduxq.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\sewlopbj.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\sgbjahol.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\skniawhn.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\sruchkxp.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\amfufmff.dll
02646028  Adware/PurityScan                  Adware              Yes       1         Yes            No           C:\WINDOWS\SYSTEM32\__C001AEF1.DAT
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00DC10F.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32	cjhvakf.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32	mxqakhr.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32	nnyteun.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32	otvoycx.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00D349E.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\uevpfseg.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\upsjwbyy.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\uvujjjvh.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\uwpdlxuu.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\vnkaesnj.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\vriingvo.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\vrtycknv.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\alfcfmqa.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\afalpmvp.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\vwpomsfo.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\vxqoajaj.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\wmedwant.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\wtqnimis.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\xblgsxnj.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\jvweggdw.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\xhoglblq.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\xnyykcps.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\xpikvidp.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00CA1D9.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\xypqmogf.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\yahoardj.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\ymsmhrec.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\yogxvasc.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\yowsikhr.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\yyhbalea.dll
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00112F6.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0015734.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0017B6D.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0019B71.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c001BDF7.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c001EA6C.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0027E2E.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c002EE6D.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0032366.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c003E804.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0043640.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c004C530.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00504C4.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00548FA.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0060E8E.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00763FC.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c007919.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c007A80C.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0080376.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c008A824.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00911CD.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c0093154.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00945E6.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c009BC73.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c009D24A.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00A390D.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00A51E4.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00A6AE4.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00A945A.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00AC702.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00AD20E.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00B08B9.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00B7B2C.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00BEB81.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00C324C.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00C8927.dat
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\WINDOWS\system32\__c00FEA9F.dat
02688352  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\xxsqisun.dll
02812101  Spyware/Vundo                      Spyware             No        0         Yes            No           C:\WINDOWS\system32	unsulem.dll
02812103  Spyware/Vundo                      Spyware             No        0         Yes            No           C:\WINDOWS\system32\ffwvdrta.dll
02882933  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\aqllxdoh.dll
02884602  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\qgblrlhc.dll
02885039  Spyware/Vundo                      Spyware             No        0         Yes            No           C:\WINDOWS\system32\sthxxxdl.dll
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
C:\PROGRAM FILES\ANALOG DEVICES\SOUNDMAX\SMAGENT.EXE
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
C:\PROGRAM FILES\TREND MICRO\OFFICESCAN CLIENT\NTRTSCAN.EXE
C:\PROGRAM FILES\TREND MICRO\OFFICESCAN CLIENT\PCCNTMON.EXE
C:\PROGRAM FILES\TREND MICRO\OFFICESCAN CLIENT\TMLISTEN.EXE
C:\PROGRAM FILES\ULTRAVNC\WINVNC.EXE
C:\WINDOWS\SYSTEM32\HKCMD.EXE
C:\WINDOWS\TEMP\LYC457.EXE
;===================================================================================================================================================================================

nardino · Answer

Bonsoir, 
En plus de ce que je t'ai préconisé plus haut, ajoutes ceci :
Télécharge VirtumondoBegone : 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Redémarre en mode sans échec et lance VirtumundoBeGone.exe.
Et poste le rapport.

Pour supprimer Purity en mode manuel:
Tu crées un fichier fix-reg
Dans un blocnote ( Tous les programmes-Accessoires) tu copies-colles ce qui suit en gras.
Dans Format, veille à bien retirer la coche devant Retour à la ligne automatique.
Fais un retour chariot ( Entrée) après la dernière ligne.

REGEDIT4

[HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]
"ContentService"=-
[-HKEY_CURRENT_USER\software\purityscan]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ddaya]


Dans Fichier, Enregistrer sous, Tous les fichiers, sur le bureau tu enregistres sous le nom fix.reg
Si le fichier obtenu est appelé fix.reg.txt, tu le renommes en supprimant .txt à la fin

Ensuite tu double-clique sur ce fichier et tu choisis Fusionner et tu acceptes.
Un message t'avertira de la bonne exécution du fix.
L'icône du fichier : https://www.118712.fr/sortir.html

Télécharge OTMoveIt :
 http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe 
Sur ton bureau. Important.

Tu le lances, il ne nécessite pas d'installation.

Tu inscris (ou tu colles) le chemin du fichier/dossier à supprimer (C'est à dire ce qui suit)dans la fenêtre de gauche (Paste List of Files/Folders to be moved) et tu cliques sur MoveIt!.
(La case Unregister Dll's and OCX's doit être cochée.)

C:\Windows\System32\winservn.exe
c:\windows\system32\ddaya.dll
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqrr.dll
C:\WINDOWS\system32\ddayw.dll
C:\WINDOWS\system32\awtsq.dll
C:\WINDOWS\system32luxrlie.dll
C:\WINDOWS\system32\fhaowlmj.dll
C:\WINDOWS\system32\xepcmvwl.dll
C:\WINDOWS\system32\gfmelyuj.dll
C:\WINDOWS\system32\vtutq.dll
C:\WINDOWS\system32\geeda.dll
C:\WINDOWS\system32\ddcyw.dll
C:\WINDOWS\system32\vtuts.dll
C:\WINDOWS\system32\ssttu.dll
C:\WINDOWS\system32\geeby.dll
C:\WINDOWS\system32\jkkll.dll
C:\WINDOWS\system32\mllji.dll
C:\WINDOWS\system32\pmnnk.dll
C:\WINDOWS\system32\cpiifaoa.dll
C:\WINDOWS\system32\cseafbxc.dll
C:\WINDOWS\system32\ddaemtih.dll
C:\WINDOWS\system32\brpemjuc.dll
C:\WINDOWS\system32\bqehejte.dll
C:\WINDOWS\system32\bovckqgn.dll
C:\WINDOWS\system32\dfogxjou.dll
C:\WINDOWS\system32\dmxjyaxy.dll
C:\WINDOWS\system32\dseddqlb.dll
C:\WINDOWS\system32\epabdjlq.dll
C:\WINDOWS\system32\etiryeum.dll
C:\WINDOWS\system32\fdlxnsjp.dll
C:\WINDOWS\system32\__c00EF3E0.dat
C:\WINDOWS\system32\fgwgkkxi.dll
C:\WINDOWS\system32\bojqsxsp.dll
C:\WINDOWS\system32\fmoqftmd.dll
C:\WINDOWS\system32\gbpsedgt.dll
C:\WINDOWS\system32\clugrabm.dll
C:\WINDOWS\system32\bjshrpxc.dll
C:\WINDOWS\system32\gfarjhlw.dll
C:\WINDOWS\system32\bhgsqktr.dll
C:\WINDOWS\system32\gkhtlkcc.dll
C:\WINDOWS\system32\gnvbtmqx.dll
C:\WINDOWS\system32\gsvgjlxe.dll
C:\WINDOWS\system32\hnyhvfpw.dll
C:\WINDOWS\system32\jbjgdcsg.dll
C:\WINDOWS\system32\jdkauwlk.dll
C:\WINDOWS\system32\cbefkmbw.dll
C:\WINDOWS\system32\jpjjscpu.dll
C:\WINDOWS\system32\bagvynet.dll
C:\WINDOWS\system32\kclcnrvc.dll
C:\WINDOWS\system32\kgvigkpd.dll
C:\WINDOWS\system32\lduekxdj.dll
C:\WINDOWS\system32\lhiorlhh.dll
C:\WINDOWS\system32\lhwjtias.dll
C:\WINDOWS\system32\lsgqooiu.dll
C:\WINDOWS\system32\mjsneruh.dll
C:\WINDOWS\system32\cnduvcws.dll
C:\WINDOWS\system32\mwctrgjb.dll
C:\WINDOWS\system32
amfmjro.dll
C:\WINDOWS\system32\oggxvnhd.dll
C:\WINDOWS\system32\oitxuhwb.dll
C:\WINDOWS\system32\osfkvevu.dll
C:\WINDOWS\system32\plvlbgii.dll
C:\WINDOWS\system32\bsfitcqg.dll
C:\WINDOWS\system32\pphcfnoj.dll
C:\WINDOWS\system32\__c00DD108.dat
C:\WINDOWS\system32\qkghvirf.dll
C:\WINDOWS\system32\__c00F77DE.dat
C:\WINDOWS\system32uboduxq.dll
C:\WINDOWS\system32\sewlopbj.dll
C:\WINDOWS\system32\sgbjahol.dll
C:\WINDOWS\system32\skniawhn.dll
C:\WINDOWS\system32\sruchkxp.dll
C:\WINDOWS\system32\amfufmff.dll
C:\WINDOWS\SYSTEM32\__C001AEF1.DAT
C:\WINDOWS\system32\__c00DC10F.dat
C:\WINDOWS\system32	cjhvakf.dll
C:\WINDOWS\system32	mxqakhr.dll
C:\WINDOWS\system32	nnyteun.dll
C:\WINDOWS\system32	otvoycx.dll
C:\WINDOWS\system32\__c00D349E.dat
C:\WINDOWS\system32\uevpfseg.dll
C:\WINDOWS\system32\upsjwbyy.dll
C:\WINDOWS\system32\uvujjjvh.dll
C:\WINDOWS\system32\uwpdlxuu.dll
C:\WINDOWS\system32\vnkaesnj.dll
C:\WINDOWS\system32\vriingvo.dll
C:\WINDOWS\system32\vrtycknv.dll
C:\WINDOWS\system32\alfcfmqa.dll
C:\WINDOWS\system32\afalpmvp.dll
C:\WINDOWS\system32\vwpomsfo.dll
C:\WINDOWS\system32\vxqoajaj.dll
C:\WINDOWS\system32\wmedwant.dll
C:\WINDOWS\system32\wtqnimis.dll
C:\WINDOWS\system32\xblgsxnj.dll
C:\WINDOWS\system32\jvweggdw.dll
C:\WINDOWS\system32\xhoglblq.dll
C:\WINDOWS\system32\xnyykcps.dll
C:\WINDOWS\system32\xpikvidp.dll
C:\WINDOWS\system32\__c00CA1D9.dat
C:\WINDOWS\system32\xypqmogf.dll
C:\WINDOWS\system32\yahoardj.dll
C:\WINDOWS\system32\ymsmhrec.dll
C:\WINDOWS\system32\yogxvasc.dll
C:\WINDOWS\system32\yowsikhr.dll
C:\WINDOWS\system32\yyhbalea.dll
C:\WINDOWS\system32\__c00112F6.dat
C:\WINDOWS\system32\__c0015734.dat
C:\WINDOWS\system32\__c0017B6D.dat
C:\WINDOWS\system32\__c0019B71.dat
C:\WINDOWS\system32\__c001BDF7.dat
C:\WINDOWS\system32\__c001EA6C.dat
C:\WINDOWS\system32\__c0027E2E.dat
C:\WINDOWS\system32\__c002EE6D.dat
C:\WINDOWS\system32\__c0032366.dat
C:\WINDOWS\system32\__c003E804.dat
C:\WINDOWS\system32\__c0043640.dat
C:\WINDOWS\system32\__c004C530.dat
C:\WINDOWS\system32\__c00504C4.dat
C:\WINDOWS\system32\__c00548FA.dat
C:\WINDOWS\system32\__c0060E8E.dat
C:\WINDOWS\system32\__c00763FC.dat
C:\WINDOWS\system32\__c007919.dat
C:\WINDOWS\system32\__c007A80C.dat
C:\WINDOWS\system32\__c0080376.dat
C:\WINDOWS\system32\__c008A824.dat
C:\WINDOWS\system32\__c00911CD.dat
C:\WINDOWS\system32\__c0093154.dat
C:\WINDOWS\system32\__c00945E6.dat
C:\WINDOWS\system32\__c009BC73.dat
C:\WINDOWS\system32\__c009D24A.dat
C:\WINDOWS\system32\__c00A390D.dat
C:\WINDOWS\system32\__c00A51E4.dat
C:\WINDOWS\system32\__c00A6AE4.dat
C:\WINDOWS\system32\__c00A945A.dat
C:\WINDOWS\system32\__c00AC702.dat
C:\WINDOWS\system32\__c00AD20E.dat
C:\WINDOWS\system32\__c00B08B9.dat
C:\WINDOWS\system32\__c00B7B2C.dat
C:\WINDOWS\system32\__c00BEB81.dat
C:\WINDOWS\system32\__c00C324C.dat
C:\WINDOWS\system32\__c00C8927.dat
C:\WINDOWS\system32\__c00FEA9F.dat
C:\WINDOWS\system32\xxsqisun.dll
C:\WINDOWS\system32\ffwvdrta.dll
C:\WINDOWS\system32\qgblrlhc.dll
C:\WINDOWS\system32\sthxxxdl.dll


Le fichier passe alors dans la fenêtre de droite.
Et tu obtiendras à la racine du système un dossier C:\_OTMoveIt
Dans ce dernier un sous-dossier Moved Files dans lequel il y aura une sauvegarde du/des fichier(s) supprimé(s) et un fichier de ce type
 ********_******.log (mm/jj/aaaa_hh/mm/ss = date et horaire de la suppression).
Tu le posteras par copier-coller pour contrôle.

Si un redémarrage est demandé, accepte-le après avoir fermé tes applications en cours et terminé la procédure.

Et pour finir dans : C:\Program Files
Tu supprimes le dossier Purity Scan en totalité.

phil.douai · Answer

Bonjour,

J'ai effectué les maips, voici les rapports :

VUNDOFIX :


VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 08:09:36 14/12/2007

Listing files found while scanning....

C:\windows\system32\__c00112F6.dat
C:\windows\system32\__c0015734.dat
C:\windows\system32\__c0017B6D.dat
C:\windows\system32\__c0019B71.dat
C:\windows\system32\__c001AEF1.dat
C:\windows\system32\__c001BDF7.dat
C:\windows\system32\__c001EA6C.dat
C:\windows\system32\__c0027E2E.dat
C:\windows\system32\__c002EE6D.dat
C:\windows\system32\__c0032366.dat
C:\windows\system32\__c003E804.dat
C:\windows\system32\__c0043640.dat
C:\windows\system32\__c004C530.dat
C:\windows\system32\__c00504C4.dat
C:\windows\system32\__c00548FA.dat
C:\windows\system32\__c0060E8E.dat
C:\windows\system32\__c00763FC.dat
C:\windows\system32\__c007919.dat
C:\windows\system32\__c007A80C.dat
C:\windows\system32\__c0080376.dat
C:\windows\system32\__c008A824.dat
C:\windows\system32\__c00911CD.dat
C:\windows\system32\__c0093154.dat
C:\windows\system32\__c00945E6.dat
C:\windows\system32\__c009BC73.dat
C:\windows\system32\__c009D24A.dat
C:\windows\system32\__c00A390D.dat
C:\windows\system32\__c00A51E4.dat
C:\windows\system32\__c00A6AE4.dat
C:\windows\system32\__c00A945A.dat
C:\windows\system32\__c00AC702.dat
C:\windows\system32\__c00AD20E.dat
C:\windows\system32\__c00B08B9.dat
C:\windows\system32\__c00B7B2C.dat
C:\windows\system32\__c00BEB81.dat
C:\windows\system32\__c00C324C.dat
C:\windows\system32\__c00C8927.dat
C:\windows\system32\__c00CA1D9.dat
C:\windows\system32\__c00D349E.dat
C:\windows\system32\__c00DC10F.dat
C:\windows\system32\__c00DD108.dat
C:\windows\system32\__c00EF3E0.dat
C:\windows\system32\__c00F77DE.dat
C:\windows\system32\__c00FEA9F.dat
C:\windows\system32\afalpmvp.dll
C:\windows\system32\alfcfmqa.dll
C:\windows\system32\amfufmff.dll
C:\windows\system32\bagvynet.dll
C:\windows\system32\bhgsqktr.dll
C:\windows\system32\bjshrpxc.dll
C:\windows\system32\bojqsxsp.dll
C:\windows\system32\bovckqgn.dll
C:\windows\system32\bqehejte.dll
C:\windows\system32\brpemjuc.dll
C:\windows\system32\bsfitcqg.dll
C:\windows\system32\cbefkmbw.dll
C:\windows\system32\clugrabm.dll
C:\windows\system32\cnduvcws.dll
C:\windows\system32\cpiifaoa.dll
C:\windows\system32\cseafbxc.dll
C:\windows\system32\ddaemtih.dll
C:\windows\system32\dfogxjou.dll
C:\windows\system32\dmxjyaxy.dll
C:\windows\system32\dseddqlb.dll
C:\windows\system32\epabdjlq.dll
C:\windows\system32\etiryeum.dll
C:\windows\system32\fdlxnsjp.dll
C:\windows\system32\fgwgkkxi.dll
C:\windows\system32\fmoqftmd.dll
C:\windows\system32\gbpsedgt.dll
C:\windows\system32\gfarjhlw.dll
C:\windows\system32\gkhtlkcc.dll
C:\windows\system32\gnvbtmqx.dll
C:\windows\system32\gsvgjlxe.dll
C:\windows\system32\hnyhvfpw.dll
C:\windows\system32\jbjgdcsg.dll
C:\windows\system32\jdkauwlk.dll
C:\windows\system32\jpjjscpu.dll
C:\windows\system32\jvweggdw.dll
C:\windows\system32\kclcnrvc.dll
C:\windows\system32\kgvigkpd.dll
C:\windows\system32\lduekxdj.dll
C:\windows\system32\lhiorlhh.dll
C:\windows\system32\lhwjtias.dll
C:\windows\system32\lsgqooiu.dll
C:\windows\system32\mjsneruh.dll
C:\windows\system32\mwctrgjb.dll
C:\windows\system32
amfmjro.dll
C:\windows\system32\oggxvnhd.dll
C:\windows\system32\oitxuhwb.dll
C:\windows\system32\osfkvevu.dll
C:\windows\system32\plvlbgii.dll
C:\windows\system32\pphcfnoj.dll
C:\windows\system32\prybxyjt.dll
C:\windows\system32\qkghvirf.dll
C:\WINDOWS\system32\qtutv.bak1
C:\WINDOWS\system32\qtutv.bak2
C:\WINDOWS\system32\qtutv.ini
C:\windows\system32uboduxq.dll
C:\windows\system32\sewlopbj.dll
C:\windows\system32\sgbjahol.dll
C:\windows\system32\skniawhn.dll
C:\windows\system32\sruchkxp.dll
C:\windows\system32	cjhvakf.dll
C:\windows\system32	mxqakhr.dll
C:\windows\system32	nnyteun.dll
C:\windows\system32	otvoycx.dll
C:\windows\system32\uevpfseg.dll
C:\windows\system32\upsjwbyy.dll
C:\windows\system32\uvujjjvh.dll
C:\windows\system32\uwpdlxuu.dll
C:\windows\system32\vnkaesnj.dll
C:\windows\system32\vriingvo.dll
C:\windows\system32\vrtycknv.dll
C:\WINDOWS\system32\vtutq.dll
C:\windows\system32\vwpomsfo.dll
C:\windows\system32\vxqoajaj.dll
C:\windows\system32\wmedwant.dll
C:\windows\system32\wtqnimis.dll
C:\windows\system32\xblgsxnj.dll
C:\windows\system32\xhoglblq.dll
C:\windows\system32\xnyykcps.dll
C:\windows\system32\xpikvidp.dll
C:\windows\system32\xypqmogf.dll
C:\windows\system32\yahoardj.dll
C:\windows\system32\ymsmhrec.dll
C:\windows\system32\yogxvasc.dll
C:\windows\system32\yowsikhr.dll
C:\windows\system32\yyhbalea.dll

Beginning removal...

 Attempting to delete C:\windows\system32\__c00112F6.dat
C:\windows\system32\__c00112F6.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0015734.dat
C:\windows\system32\__c0015734.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0017B6D.dat
C:\windows\system32\__c0017B6D.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0019B71.dat
C:\windows\system32\__c0019B71.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c001AEF1.dat
C:\windows\system32\__c001AEF1.dat Could not be deleted.

 Attempting to delete C:\windows\system32\__c001BDF7.dat
C:\windows\system32\__c001BDF7.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c001EA6C.dat
C:\windows\system32\__c001EA6C.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0027E2E.dat
C:\windows\system32\__c0027E2E.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c002EE6D.dat
C:\windows\system32\__c002EE6D.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0032366.dat
C:\windows\system32\__c0032366.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c003E804.dat
C:\windows\system32\__c003E804.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0043640.dat
C:\windows\system32\__c0043640.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c004C530.dat
C:\windows\system32\__c004C530.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00504C4.dat
C:\windows\system32\__c00504C4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00548FA.dat
C:\windows\system32\__c00548FA.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0060E8E.dat
C:\windows\system32\__c0060E8E.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00763FC.dat
C:\windows\system32\__c00763FC.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c007919.dat
C:\windows\system32\__c007919.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c007A80C.dat
C:\windows\system32\__c007A80C.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0080376.dat
C:\windows\system32\__c0080376.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c008A824.dat
C:\windows\system32\__c008A824.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00911CD.dat
C:\windows\system32\__c00911CD.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0093154.dat
C:\windows\system32\__c0093154.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00945E6.dat
C:\windows\system32\__c00945E6.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c009BC73.dat
C:\windows\system32\__c009BC73.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c009D24A.dat
C:\windows\system32\__c009D24A.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00A390D.dat
C:\windows\system32\__c00A390D.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00A51E4.dat
C:\windows\system32\__c00A51E4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00A6AE4.dat
C:\windows\system32\__c00A6AE4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00A945A.dat
C:\windows\system32\__c00A945A.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00AC702.dat
C:\windows\system32\__c00AC702.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00AD20E.dat
C:\windows\system32\__c00AD20E.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00B08B9.dat
C:\windows\system32\__c00B08B9.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00B7B2C.dat
C:\windows\system32\__c00B7B2C.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00BEB81.dat
C:\windows\system32\__c00BEB81.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00C324C.dat
C:\windows\system32\__c00C324C.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00C8927.dat
C:\windows\system32\__c00C8927.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00CA1D9.dat
C:\windows\system32\__c00CA1D9.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00D349E.dat
C:\windows\system32\__c00D349E.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00DC10F.dat
C:\windows\system32\__c00DC10F.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00DD108.dat
C:\windows\system32\__c00DD108.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00EF3E0.dat
C:\windows\system32\__c00EF3E0.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00F77DE.dat
C:\windows\system32\__c00F77DE.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00FEA9F.dat
C:\windows\system32\__c00FEA9F.dat Has been deleted!

 Attempting to delete C:\windows\system32\afalpmvp.dll
C:\windows\system32\afalpmvp.dll Has been deleted!

 Attempting to delete C:\windows\system32\alfcfmqa.dll
C:\windows\system32\alfcfmqa.dll Has been deleted!

 Attempting to delete C:\windows\system32\amfufmff.dll
C:\windows\system32\amfufmff.dll Has been deleted!

 Attempting to delete C:\windows\system32\bagvynet.dll
C:\windows\system32\bagvynet.dll Has been deleted!

 Attempting to delete C:\windows\system32\bhgsqktr.dll
C:\windows\system32\bhgsqktr.dll Has been deleted!

 Attempting to delete C:\windows\system32\bjshrpxc.dll
C:\windows\system32\bjshrpxc.dll Has been deleted!

 Attempting to delete C:\windows\system32\bojqsxsp.dll
C:\windows\system32\bojqsxsp.dll Has been deleted!

 Attempting to delete C:\windows\system32\bovckqgn.dll
C:\windows\system32\bovckqgn.dll Has been deleted!

 Attempting to delete C:\windows\system32\bqehejte.dll
C:\windows\system32\bqehejte.dll Has been deleted!

 Attempting to delete C:\windows\system32\brpemjuc.dll
C:\windows\system32\brpemjuc.dll Has been deleted!

 Attempting to delete C:\windows\system32\bsfitcqg.dll
C:\windows\system32\bsfitcqg.dll Has been deleted!

 Attempting to delete C:\windows\system32\cbefkmbw.dll
C:\windows\system32\cbefkmbw.dll Has been deleted!

 Attempting to delete C:\windows\system32\clugrabm.dll
C:\windows\system32\clugrabm.dll Has been deleted!

 Attempting to delete C:\windows\system32\cnduvcws.dll
C:\windows\system32\cnduvcws.dll Has been deleted!

 Attempting to delete C:\windows\system32\cpiifaoa.dll
C:\windows\system32\cpiifaoa.dll Has been deleted!

 Attempting to delete C:\windows\system32\cseafbxc.dll
C:\windows\system32\cseafbxc.dll Has been deleted!

 Attempting to delete C:\windows\system32\ddaemtih.dll
C:\windows\system32\ddaemtih.dll Has been deleted!

 Attempting to delete C:\windows\system32\dfogxjou.dll
C:\windows\system32\dfogxjou.dll Has been deleted!

 Attempting to delete C:\windows\system32\dmxjyaxy.dll
C:\windows\system32\dmxjyaxy.dll Has been deleted!

 Attempting to delete C:\windows\system32\dseddqlb.dll
C:\windows\system32\dseddqlb.dll Has been deleted!

 Attempting to delete C:\windows\system32\epabdjlq.dll
C:\windows\system32\epabdjlq.dll Has been deleted!

 Attempting to delete C:\windows\system32\etiryeum.dll
C:\windows\system32\etiryeum.dll Has been deleted!

 Attempting to delete C:\windows\system32\fdlxnsjp.dll
C:\windows\system32\fdlxnsjp.dll Has been deleted!

 Attempting to delete C:\windows\system32\fgwgkkxi.dll
C:\windows\system32\fgwgkkxi.dll Has been deleted!

 Attempting to delete C:\windows\system32\fmoqftmd.dll
C:\windows\system32\fmoqftmd.dll Has been deleted!

 Attempting to delete C:\windows\system32\gbpsedgt.dll
C:\windows\system32\gbpsedgt.dll Has been deleted!

 Attempting to delete C:\windows\system32\gfarjhlw.dll
C:\windows\system32\gfarjhlw.dll Has been deleted!

 Attempting to delete C:\windows\system32\gkhtlkcc.dll
C:\windows\system32\gkhtlkcc.dll Has been deleted!

 Attempting to delete C:\windows\system32\gnvbtmqx.dll
C:\windows\system32\gnvbtmqx.dll Has been deleted!

 Attempting to delete C:\windows\system32\gsvgjlxe.dll
C:\windows\system32\gsvgjlxe.dll Has been deleted!

 Attempting to delete C:\windows\system32\hnyhvfpw.dll
C:\windows\system32\hnyhvfpw.dll Has been deleted!

 Attempting to delete C:\windows\system32\jbjgdcsg.dll
C:\windows\system32\jbjgdcsg.dll Has been deleted!

 Attempting to delete C:\windows\system32\jdkauwlk.dll
C:\windows\system32\jdkauwlk.dll Has been deleted!

 Attempting to delete C:\windows\system32\jpjjscpu.dll
C:\windows\system32\jpjjscpu.dll Has been deleted!

 Attempting to delete C:\windows\system32\jvweggdw.dll
C:\windows\system32\jvweggdw.dll Has been deleted!

 Attempting to delete C:\windows\system32\kclcnrvc.dll
C:\windows\system32\kclcnrvc.dll Has been deleted!

 Attempting to delete C:\windows\system32\kgvigkpd.dll
C:\windows\system32\kgvigkpd.dll Has been deleted!

 Attempting to delete C:\windows\system32\lduekxdj.dll
C:\windows\system32\lduekxdj.dll Has been deleted!

 Attempting to delete C:\windows\system32\lhiorlhh.dll
C:\windows\system32\lhiorlhh.dll Has been deleted!

 Attempting to delete C:\windows\system32\lhwjtias.dll
C:\windows\system32\lhwjtias.dll Has been deleted!

 Attempting to delete C:\windows\system32\lsgqooiu.dll
C:\windows\system32\lsgqooiu.dll Has been deleted!

 Attempting to delete C:\windows\system32\mjsneruh.dll
C:\windows\system32\mjsneruh.dll Has been deleted!

 Attempting to delete C:\windows\system32\mwctrgjb.dll
C:\windows\system32\mwctrgjb.dll Has been deleted!

 Attempting to delete C:\windows\system32
amfmjro.dll
C:\windows\system32
amfmjro.dll Has been deleted!

 Attempting to delete C:\windows\system32\oggxvnhd.dll
C:\windows\system32\oggxvnhd.dll Has been deleted!

 Attempting to delete C:\windows\system32\oitxuhwb.dll
C:\windows\system32\oitxuhwb.dll Has been deleted!

 Attempting to delete C:\windows\system32\osfkvevu.dll
C:\windows\system32\osfkvevu.dll Has been deleted!

 Attempting to delete C:\windows\system32\plvlbgii.dll
C:\windows\system32\plvlbgii.dll Has been deleted!

 Attempting to delete C:\windows\system32\pphcfnoj.dll
C:\windows\system32\pphcfnoj.dll Has been deleted!

 Attempting to delete C:\windows\system32\prybxyjt.dll
C:\windows\system32\prybxyjt.dll Has been deleted!

 Attempting to delete C:\windows\system32\qkghvirf.dll
C:\windows\system32\qkghvirf.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qtutv.bak1
C:\WINDOWS\system32\qtutv.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qtutv.bak2
C:\WINDOWS\system32\qtutv.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qtutv.ini
C:\WINDOWS\system32\qtutv.ini Has been deleted!

 Attempting to delete C:\windows\system32uboduxq.dll
C:\windows\system32uboduxq.dll Has been deleted!

 Attempting to delete C:\windows\system32\sewlopbj.dll
C:\windows\system32\sewlopbj.dll Has been deleted!

 Attempting to delete C:\windows\system32\sgbjahol.dll
C:\windows\system32\sgbjahol.dll Has been deleted!

 Attempting to delete C:\windows\system32\skniawhn.dll
C:\windows\system32\skniawhn.dll Has been deleted!

 Attempting to delete C:\windows\system32\sruchkxp.dll
C:\windows\system32\sruchkxp.dll Has been deleted!

 Attempting to delete C:\windows\system32	cjhvakf.dll
C:\windows\system32	cjhvakf.dll Has been deleted!

 Attempting to delete C:\windows\system32	mxqakhr.dll
C:\windows\system32	mxqakhr.dll Has been deleted!

 Attempting to delete C:\windows\system32	nnyteun.dll
C:\windows\system32	nnyteun.dll Has been deleted!

 Attempting to delete C:\windows\system32	otvoycx.dll
C:\windows\system32	otvoycx.dll Has been deleted!

 Attempting to delete C:\windows\system32\uevpfseg.dll
C:\windows\system32\uevpfseg.dll Has been deleted!

 Attempting to delete C:\windows\system32\upsjwbyy.dll
C:\windows\system32\upsjwbyy.dll Has been deleted!

 Attempting to delete C:\windows\system32\uvujjjvh.dll
C:\windows\system32\uvujjjvh.dll Has been deleted!

 Attempting to delete C:\windows\system32\uwpdlxuu.dll
C:\windows\system32\uwpdlxuu.dll Has been deleted!

 Attempting to delete C:\windows\system32\vnkaesnj.dll
C:\windows\system32\vnkaesnj.dll Has been deleted!

 Attempting to delete C:\windows\system32\vriingvo.dll
C:\windows\system32\vriingvo.dll Has been deleted!

 Attempting to delete C:\windows\system32\vrtycknv.dll
C:\windows\system32\vrtycknv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vtutq.dll
C:\WINDOWS\system32\vtutq.dll Has been deleted!

 Attempting to delete C:\windows\system32\vwpomsfo.dll
C:\windows\system32\vwpomsfo.dll Has been deleted!

 Attempting to delete C:\windows\system32\vxqoajaj.dll
C:\windows\system32\vxqoajaj.dll Has been deleted!

 Attempting to delete C:\windows\system32\wmedwant.dll
C:\windows\system32\wmedwant.dll Has been deleted!

 Attempting to delete C:\windows\system32\wtqnimis.dll
C:\windows\system32\wtqnimis.dll Has been deleted!

 Attempting to delete C:\windows\system32\xblgsxnj.dll
C:\windows\system32\xblgsxnj.dll Has been deleted!

 Attempting to delete C:\windows\system32\xhoglblq.dll
C:\windows\system32\xhoglblq.dll Has been deleted!

 Attempting to delete C:\windows\system32\xnyykcps.dll
C:\windows\system32\xnyykcps.dll Has been deleted!

 Attempting to delete C:\windows\system32\xpikvidp.dll
C:\windows\system32\xpikvidp.dll Has been deleted!

 Attempting to delete C:\windows\system32\xypqmogf.dll
C:\windows\system32\xypqmogf.dll Has been deleted!

 Attempting to delete C:\windows\system32\yahoardj.dll
C:\windows\system32\yahoardj.dll Has been deleted!

 Attempting to delete C:\windows\system32\ymsmhrec.dll
C:\windows\system32\ymsmhrec.dll Has been deleted!

 Attempting to delete C:\windows\system32\yogxvasc.dll
C:\windows\system32\yogxvasc.dll Has been deleted!

 Attempting to delete C:\windows\system32\yowsikhr.dll
C:\windows\system32\yowsikhr.dll Has been deleted!

 Attempting to delete C:\windows\system32\yyhbalea.dll
C:\windows\system32\yyhbalea.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...



COMBOFIX :
Il y a eu plusieurs étapes puis une fenêtre "Deleting files/folders". Pas d'autres messages, j'ai rebooté le pc

ComboFix 07-12-14.4 - dducoulombier 2007-12-14  8:48:34.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.1.1036.18.163 [GMT 1:00]
Running from: C:\sav\ComboFix.exe


VIRTUMUNDOBEGONE :


[12/14/2007, 9:15:00] - VirtumundoBeGone v1.5 ( "C:\sav\VirtumundoBeGone.exe" )
[12/14/2007, 9:15:07] - Detected System Information:
[12/14/2007, 9:15:07] -  Windows Version: 5.1.2600, Service Pack 2
[12/14/2007, 9:15:07] -  Current Username: dducoulombier (Admin)
[12/14/2007, 9:15:07] -  Windows is in SAFE mode.
[12/14/2007, 9:15:07] - Searching for Browser Helper Objects:
[12/14/2007, 9:15:07] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[12/14/2007, 9:15:07] -  BHO 2: {6278f958-05b5-4c02-a6de-eba91417fb32} ()
[12/14/2007, 9:15:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/14/2007, 9:15:07] -  Checking for HKLM\...\Winlogon\Notify\aifkfolo
[12/14/2007, 9:15:07] -  Key not found: HKLM\...\Winlogon\Notify\aifkfolo, continuing.
[12/14/2007, 9:15:07] -  BHO 3: {77058708-B23F-44D1-BD3A-890D226ABA3C} ()
[12/14/2007, 9:15:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/14/2007, 9:15:07] -  Checking for HKLM\...\Winlogon\Notify\sstqp
[12/14/2007, 9:15:07] -  Key not found: HKLM\...\Winlogon\Notify\sstqp, continuing.
[12/14/2007, 9:15:07] -  BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[12/14/2007, 9:15:07] - Finished Searching Browser Helper Objects
[12/14/2007, 9:15:07] - Finishing up...
[12/14/2007, 9:15:07] - Nothing found! Exiting...

J'ai aussi supprimé Purity.

A bientôt pour la suite !


.

nardino · Answer

Bonsoir.

Rencontres-tu encore des problèmes ?
Si oui lesquels ?

phil.douai · Answer

Bonjour,

Non, plus de pb ! Merci encore !

nardino · Answer

Bonjour,

Supprimes Vundofix, Virtumonde, Combofix et les rapports établis par ces outils ainsi que le fichier fix.reg.
Il faut procéder à la mise à jour du programme suivant :

-Java Runtime Environment (JRE)6u3 :
https://www.oracle.com/java/technologies/javase-downloads.html
Clique sur Download Java Runtime Environment (JRE) 6u3
Dans la page suivante coche [b]Iaccept[/b] et télécharge [b] Windows Offline Installation, Multi-language //jre-6u3-windows-i586-p.exe //13.89 MB[/b]
Tu l'installeras hors connexion.
Dans Ajout/Suppression des programmes tu supprimes toutes les autres versions. 
Dans Démarrer, tape appwiz.cpl, puis Entrée et supprime toutes les autres versions.

Présence de troyans... help, merci !

11 réponses

Discussions similaires