INFECTER ?? Fermé

Question

Bonjour,
Est ce que vous pouvez me dire si je suis infécté merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:18:07, on 16/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32
vraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\jv16 PowerTools\jv16 PowerTools.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 124.217.252.77 www.bravesentry.com
O1 - Hosts: 124.217.252.77 bravesentry.com
O1 - Hosts: 124.217.252.78 secure.isoftpay.com
O1 - Hosts: 124.217.252.77 www.bravesentry.com
O1 - Hosts: 124.217.252.77 bravesentry.com
O1 - Hosts: 124.217.252.78 secure.isoftpay.com
O1 - Hosts: 124.217.252.77 www.bravesentry.com
O1 - Hosts: 124.217.252.77 bravesentry.com
O1 - Hosts: 124.217.252.78 secure.isoftpay.com
O1 - Hosts: 124.217.252.77 www.bravesentry.com
O1 - Hosts: 124.217.252.77 bravesentry.com
O1 - Hosts: 124.217.252.78 secure.isoftpay.com
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

ep44 · Answer

Bonjour,

Télécharge sur ton bureau RHosts (Merci à S!ri) disponible ici,
http://siri.urz.free.fr/Softs/RHosts.exe
Double-clique sur Rhosts.exe et clique sur "restaurer".

ensuite refais un nouveau hijack
@+

loganpro · Answer

Merci de ta réponse tres rapide alors voila le résultat apres avoir utilisé Rhosts
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:40:31, on 16/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32
vraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

ep44 · Answer

;-) beaucoup mieux 

Télécharge:
http://www.grisoft.cz/filedir/inst/avgas-setup-7.5.1.43.exe AVG-AntiSpyware
= Installer
= Le lancer
= Clic : Mise à jour
------
= Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.

Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
= Dans ANALYSE ( en forme de loupe )
==> Paramètres ==> sous COMMENT REAGIR==>clic sur Actions recommandées ==>Quarantaine
==> Clic : Analyse complète du système
En fin de scan ( qui est assez long)
==> Clic Appliquer toutes les actions <== ceci Très important
==> Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
-------
En mode normal
colle le rapport
@+

loganpro · Answer

Merci lol je sais démarré en mode sans echec ^^
Alors comme sa je suis infécté hmm
Kaspersky ma détécté 47 virus trojan etc que des vacheries mais je pense qu'il y'en a encore donc jvai faire ce que tu me dit :)

loganpro · Answer

OUla !!
Gros probleme juste a la fin de l'instalation Ecran bleu pendant 2 seconde et redémarage  ...
Je croi que l'instalation est finie 
Donc je fait ce que tu ma dit

loganpro · Answer

J'ai encore un gros probleme si je démarre en mode normal sa marche aps sa me met un ecran bleu :( sa me faisait pas sa avant aide moi stp !! 
La je suis en mode sans echec avec prise en charge résaux

loganpro · Answer

Voila le rapport apres desinfection de avg
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:21, on 16/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

ep44 · Answer

je ne comprends pas trop tu as télécharger avg ensuite tu as fait tes mises à jours 
ensuite tu as voulu aller en mode sans échec 

as tu fait une autre manip que celle que je t'ai indiqué car bizarre

loganpro · Answer

Non j'ai télécharger avg ensuite mise a jour ensuite redemarage ensuite mode sans echec lancement avg 
Suprimé tout ce qu'il trouve redemarage normal et rapport hijack 
C'est pas sa qu'il fallai que je fasse ?

ep44 · Answer

si tout à fait ça 
mais tu me parle d'un écran bleue 
donc la tu es en mode normal ?

loganpro · Answer

Ui la je suis en mode normal mais pourquoi kaspersky me trouve encore des virus et trojan en abandance :(

loganpro · Answer

Exemple de ce q'il me trouve
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32
2ewma1xxsv2234.exe	12,5 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32\dllgh8jkd1q2.exe	30,4 Ko
Infecté : cheval de Troie Trojan-Proxy.Win32.Agent.zd	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0003499.exe	77 Ko
Infecté : cheval de Troie Trojan.Win32.Srizbi.j	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0003557.sys	164 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.VB.cop	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0002436.exe	20 Ko
Infecté : cheval de Troie Rootkit.Win32.Agent.aas	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0006550.sys	41,4 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32\dllgh8jkd1q7.exe	14 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32\dllgh8jkd1q1.exe	12,4 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32\dllgh8jkd1q5.exe	13,4 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32\wind32.exe	17,5 Ko
Infecté : cheval de Troie Rootkit.Win32.Agent.aaq	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0003551.sys	164 Ko
Infecté : cheval de Troie Rootkit.Win32.Agent.aas	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0002411.sys	41,4 Ko
Infecté : cheval de Troie Rootkit.Win32.Agent.aas	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0008556.sys	41,4 Ko
Infecté : cheval de Troie Rootkit.Win32.Agent.aas	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0003534.sys	41,4 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32
2ewma1xxsv234.exe	13,4 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.Tibs.ve	C:\WINDOWS\system32\dllgh8jkd1q6.exe	13,6 Ko
Infecté : cheval de Troie Trojan-Downloader.Win32.VB.cop	C:\System Volume Information\_restore{26A63B94-5BC8-47A6-989D-F73EB1CA1CF7}\RP12\A0003500.exe	20 Ko

loganpro · Answer

Et à l'instant mon pc vien de se redémarer tout seul >< avec encore un ecran bleus 
Franchement sa me fait chié

ep44 · Answer

on va faire un scan en ligne

avec bitdefender et colle le rapport

https://www.bitdefender.com/toolbox/

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
@+

loganpro · Answer

hmmm dés que je lance AVG sa me redémare le pc avec l'ecran bleu alors jvai le suprimé et jfait ton analyse avec bitdefender

loganpro · Answer

Bitdefender me trouve des truc mais il me dit qu'il faut que je télécharge bitdefender2008 pour les suprimé

ep44 · Answer

il t'as trouvé un rapport ??

donc poste le stp

loganpro · Answer

J'ai relancé l'analyse pasque internet explorer avait planté

loganpro · Answer

Il me dit que je suis infecté par le trojan.vundo.DVS
Et que delete failed

ep44 · Answer

dur dur sans rapport 

as tu toujours ce plantage d'écran bleue ?

loganpro · Answer

Pour l'instant je n'est plus l'ecran bleu 
J'ai télécharger vundofix pour suprimé le trojan 
Parceque la fin de l'analyse avec bitdefender est dans 1H30 oO

ep44 · Answer

bon écoute je ne peux pas t'aider si tu fait tout et n'importe quoi 
tu lance le rapport de bitdefender  et tu fait vundofix en même temps 
alors que je t'ai pas démander de faire vundo 

mais bon à toi de voir !

loganpro · Answer

Le rapport de bit defender n'est pas encore fini alors j'ai regarder sur d'autre site comment eradiqué trojan vundo car il me trouve que ça bit defender 
Merci d'etre patient l'analyse avec bitdefender n'est fini que dans 1H

loganpro · Answer

Voila le rapport de bitdefender
 
	

 
	

 

Statistics

Time
	

00:30:24

Files
	

52803

Folders
	

858

Boot Sectors
	

5

Archives
	

254

Packed Files
	

2216
	

 
	

 

Results

Identified Viruses
	

1

Infected Files
	

28

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

0
	

 
	

 

Engines Info

Virus Definitions
	

981529

Engine build
	

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
	

16

Archive plugins
	

41

Unpack plugins
	

7

E-mail plugins
	

6

System plugins
	

5
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\cfc.99CBA80E01C870DB.history\00000003.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\cfc.99CBA80E01C870DB.history\00000003.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\cfc.99CBA80E01C870DB.history\00000003.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\cfc.99CBA80E01C870DB.history\00000004.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\cfc.99CBA80E01C870DB.history\00000004.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\cfc.99CBA80E01C870DB.history\00000004.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002c.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002c.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002c.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002d.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002d.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002d.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002e.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002e.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002e.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002f.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002f.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000002f.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000063.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000063.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000063.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000064.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000064.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000064.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000065.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000065.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000065.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000066.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000066.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000066.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000067.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000067.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000067.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000068.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000068.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000068.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000069.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000069.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000069.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006a.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006a.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006a.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006b.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006b.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006b.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006c.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006c.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006c.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006d.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006d.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006d.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006e.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006e.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006e.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006f.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006f.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\0000006f.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000070.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000070.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000070.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000072.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000072.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000072.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000073.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000073.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000073.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000074.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000074.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000074.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000075.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000075.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000075.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000076.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000076.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000076.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000077.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000077.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000077.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000078.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000078.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000078.bak
	

Delete failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000079.bak
	

Infected with: Trojan.Vundo.DVS

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000079.bak
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\PdmHist\dd0.282A34A401C870DB.history\00000079.bak
	

Delete failed

ep44 · Answer

et ton rapport vundo??

loganpro · Answer

ba vundo me trouve des dll et il est encore entrain de chercher
Il ne genere pas de rapport

loganpro · Answer

Bon vundofix est fini et ma supprimé tout ce qu'il a trouvé !
Maintenant comment savoir si j'ai pu de vacheries ? 
Je lance encore hijack pour que tu analyse le rapport ?

ep44 · Answer

et bien il faut le rapport de vundo pour voir si il à bien supprimer et quoi

loganpro · Answer

C'est bon je croit que j'ai pu de virus trojan etc !
Grace a mes recherches et un peu a toi :) 
Bon Demain je lance mode sans echec avec analyse antivirus et anti espion et je verai si je trouve encore des bebete 
Si non je met comme résolus merci :=)

ep44 · Answer

ok  bye

INFECTER ??

30 réponses

Discussions similaires