Virus?

Question

Bonjour,
Je me suis inscris sur le forum récemment mais j'ai deja résolu beaucoup de problèmes sur d'autres sujets.
Aujourd'hui je n'ai pas pu trouver la solution à mon problème sur le site... J'écris donc ce message.
Hier apres un téléchargement et sans avoir analysé au préalable le fichier, Avast m'a informé qu'il y avait une menace sur mon ordinateur. J'ai donc fait en sorte de solutionner le problème avec Avast. Tout a fonctionner pendant 30 a 45 minutes mais apres ce temps mon ordinateur a gelé. J'ai donc redemarré le système.
Apres le redémarrage Avast a refait une nouvelle alerte en me disantde redémarrer (une nouvelle fois) pour faire une analyse. J'ai fait cette analyse mais je n'ai toujours pas résolu le problème...
Voila les quelques "symptomes" que j'ai relevé:
-Ordinateur tres long au demarrage
-Message d'erreur de Core Center: "Failed to Load Hardware Monitor Driver" avec une seule possibilié cliquer OK et là redemarrage de l'ordi...
-Nombreuses publicités au cours de la navigation internet
-Certains sites ne fonctionnent pas (temps de chargement trop long...)

Voila j'espere avoir donné assez d'informations et pouvoir resoudre ce probleme. 
Merci de votre aide.

Clement.

Ajbol · Accepted Answer

Bonjour,

Kit de désinfection : 

1 : Désinstalle ton antivirus actuel
2 : Télécharge Antivir, mets à jour et scanne ton système.
Tutorial FR : http://www.tutopat.com/viewtopic.php?t=2417 ou bien https://www.malekal.com/avira-free-security-antivirus-gratuit/ ou bien http://speedweb1.free.fr/frames2.php?page=tuto5
3 : Télécharge Adaware, Spybot
4 : Mets chacun de ces logiciels à jour et fais les tourner sur l’entièreté du disque dur
5 : Télécharge Ccleaner
Tutorial FR : http://www.internetmonitor.lu/download/ccleaner_27082006.pdf

6 : Reviens nous donner des nouvelles.

hafedfree1981 · Answer

bonjour 

pouvez vous nous informer quel type de menace a rencontré votr AVAST, si c'est un Trojan , 
je veux savoir juste le message signalé par l'Avast.



en attendant s'il ya des nouvelles       Bon courage.

kl3m1 · Answer

Je viens d'installer Antivir qui me met 6 avertissement impossible a fermer :-S il s'agit d'un Trojan 
TR/Vundo.Gen
J'aimerai deja quelques conseils :-) 
Merci a vous

Ajbol · Answer

Copie ton rapport ici

kl3m1 · Answer

L'analyse n'est pas terminée je vous en fait part des que c'est bon.
Je connais le nom du virus car il s'affiche dans une alerte mais aucune des solutions proposées ne fonctionne:
mettre en quarantaine
delete
rename
Deny access
ignore
En fait des que jappui sur une des propositions la fenetre disparait et reaparait aussi tot!!

kl3m1 · Answer

Ok je veux bien faire ca s'il n'y a que ca a faire. Que faut-il choisir de preference? parmis ce que j'ai mis au dessus...

Ajbol · Answer

delete !

kl3m1 · Answer

ok mais le chemin indiqué C:\WINDOWS8system32\ssqNggGV.dll ne veux rien dire? car c'est toujours le meme...
C'est vous le connaisseur pas moi je fais ce que vous dites mais je done aussi le maximum d'infos...

kl3m1 · Answer

Voila le rapport Antivir...


Avira AntiVir Personal
Report file date: mardi 29 avril 2008  13:52

Scanning for 1165085 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    GOMBEAUD

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.62       337408 Bytes  21/03/2008 19:12:34
ANTIVIR3.VDF  : 7.0.3.68        57856 Bytes  25/03/2008 08:27:50
Engineversion : 8.1.0.28  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.19       229754 Bytes  07/04/2008 15:34:44
AESCN.DLL     : 8.1.0.12       115060 Bytes  07/04/2008 15:34:44
AERDL.DLL     : 8.1.0.19       418164 Bytes  07/04/2008 15:34:44
AEPACK.DLL    : 8.1.1.0        364918 Bytes  18/03/2008 11:20:42
AEOFFICE.DLL  : 8.1.0.15       192889 Bytes  07/04/2008 15:34:44
AEHEUR.DLL    : 8.1.0.15      1147253 Bytes  07/04/2008 15:34:44
AEHELP.DLL    : 8.1.0.11       115061 Bytes  07/04/2008 15:34:43
AEGEN.DLL     : 8.1.0.15       299379 Bytes  07/04/2008 15:34:43
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.25       168309 Bytes  08/04/2008 09:58:32
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 29 avril 2008  13:52

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '0' Module(s) have been scanned
Scan process 'iexplore.exe' - '0' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'AcroRd32.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '0' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'MSN Pictures Displayer.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'DSLMON.exe' - '1' Module(s) have been scanned
Scan process 'CoreCenter.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'Core.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'LowLight.exe' - '1' Module(s) have been scanned
Scan process 'Domino.exe' - '1' Module(s) have been scanned
Scan process 'ZSSnp211.exe' - '1' Module(s) have been scanned
Scan process 'PSPAP.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'DAP.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmon.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmgr.exe' - '1' Module(s) have been scanned
Scan process 'LogiTray.exe' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'DrgToDsc.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'libusbd-nt.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned
Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
78 processes with 78 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '48' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{CAD93D76-CD68-4F37-95E9-769ECD1AB769}\RP777\A0151401.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\System Volume Information\_restore{CAD93D76-CD68-4F37-95E9-769ECD1AB769}\RP777\A0151402.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
C:\WINDOWS\system32\ssqNggGV.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!


End of the scan: mardi 29 avril 2008  14:43
Used time: 50:39 min

The scan has been done completely.

   7805 Scanning directories
 325328 Files were scanned
      3 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 325325 Files not concerned
   3122 Archives were scanned
      3 Warnings
      2 Notes

Ajbol · Answer

Ca avance bien.

Repasse une fois antivir sur tout le disque dur et poste le rapport.  Si tu ne parviens pas à détruire, essaie la mise en quarantaine.

kl3m1 · Answer

Ok ca avance bien bah tant mieux :-)
Mais le cheval de Troie il faudra bien qu'il se supprime defiitivement non? parce que sinon il va encore faire des petits... non?
Bon je refait une analyse alors....
Merci

Ajbol · Answer

S'il est en quarantaine, il est isolé.

kl3m1 · Answer

oui D'accord... est-il normal que si je laisse la fenetre Antivir telle qu'elle est il n'y a plus d'autres messages d'alerte?... 
Je veux dire que dès que j'ai cliqué sur le message un autre reaparait mais maintenant (contrairement a tout a l'heure), il n'y a qu'un message a la fois... avec le meme chemin indiqué plus haut...

Ajbol · Answer

Oui....  Il faudra faire tourner antivir autant de fois que nécessaire jusqu'à ce que tout rentre dans l'ordre.
N'oublie pas de le mettre à jour.

kl3m1 · Answer

Voila le message d'erreur affiché a la fin de l'analyse:

The file could not copied to quarantine!
C:\WINDOWS\system32\ssqNggGV.dll

you may not have the requiered permission or the file is locked.
Please make sure that you have administrative rights for this action

Is the Trojan horse TR/Vundo.Gen

Deux choix possibles

-Delete locked files atfer reboot
-Ignore

Voila pour cette premiere info
Je copie le rapport ci dessous

kl3m1 · Answer

Heu je ne peux pas mettre le rapport parce qu'il faut que je reponde avant a la fenetre precedente... 
Que dois-je mettre?

kl3m1 · Answer

up

kl3m1 · Answer

Avira AntiVir Personal
Report file date: mardi 29 avril 2008  15:07

Scanning for 1165085 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    GOMBEAUD

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.62       337408 Bytes  21/03/2008 19:12:34
ANTIVIR3.VDF  : 7.0.3.68        57856 Bytes  25/03/2008 08:27:50
Engineversion : 8.1.0.28  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.19       229754 Bytes  07/04/2008 15:34:44
AESCN.DLL     : 8.1.0.12       115060 Bytes  07/04/2008 15:34:44
AERDL.DLL     : 8.1.0.19       418164 Bytes  07/04/2008 15:34:44
AEPACK.DLL    : 8.1.1.0        364918 Bytes  18/03/2008 11:20:42
AEOFFICE.DLL  : 8.1.0.15       192889 Bytes  07/04/2008 15:34:44
AEHEUR.DLL    : 8.1.0.15      1147253 Bytes  07/04/2008 15:34:44
AEHELP.DLL    : 8.1.0.11       115061 Bytes  07/04/2008 15:34:43
AEGEN.DLL     : 8.1.0.15       299379 Bytes  07/04/2008 15:34:43
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.25       168309 Bytes  08/04/2008 09:58:32
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 29 avril 2008  15:07

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'MSN Pictures Displayer.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'DSLMON.exe' - '1' Module(s) have been scanned
Scan process 'CoreCenter.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'Core.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'Domino.exe' - '1' Module(s) have been scanned
Scan process 'ZSSnp211.exe' - '1' Module(s) have been scanned
Scan process 'PSPAP.exe' - '1' Module(s) have been scanned
Scan process 'LowLight.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmon.exe' - '1' Module(s) have been scanned
Scan process 'DAP.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmgr.exe' - '1' Module(s) have been scanned
Scan process 'LogiTray.exe' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'DrgToDsc.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'libusbd-nt.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
67 processes with 67 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '48' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\ssqNggGV.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 26003
      [WARNING]   
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!


End of the scan: mardi 29 avril 2008  18:24
Used time:  3:17:40 min

The scan has been done completely.

   7806 Scanning directories
 325508 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 325507 Files not concerned
   3122 Archives were scanned
      3 Warnings
      0 Notes

hafedfree1981 · Answer

Bonsoir à tous, 

d'aprés de ce que je vois, il est clair que l'avast detecte cette infection mais reste incapable de neutraliser TR/vundo , comme je pense ce type de trojan intègre lui même dans des fichiers système qu'il faut pas les supprimer alors là l'avast s'est coincé.

donc essaye de télécharger le Remover dite : VundoFixer.exe ( qui est utilsé pour neutraliser ce genre d'infection, heureusement depuis l'année 2006)

http://www.atribune.org/ccount/click.php?id=4  

à la fin il vous faut relancer votre pc 


bon courage

kl3m1 · Answer

Bonjour il y a des nouvelles ce matin... Hier apres avoir redémarré mon ordinateur je n'ai plus de bureau...
Antivir m'avais dit de supprimer le Virus apres Reboot mais apparament il a supprimer des fichier systeme... c'est la deduction que j'en ai faite... Je peux reussir a vous parler depuis le gestionnaire de taches mais c'est de plus en plus compliqué...
Merci de vos reponses (j'ai telechargé Vundo Fixer qui est en cours de fonctionnement)

kl3m1 · Answer

Heu rectification en fait mon bureau est apparu apres que j'ai ecris mon message (imaginez le temps) J'espere que mon systeme n'est pas trop attaqué... il faut vraiment que je vire ce truc!
Merci a vous

kl3m1 · Answer

Voila l'analyse avec vundo fixer est terminée que dois-je choisir maintenant? désolé pour les nombreux message mais je fais les choses une par une...

kl3m1 · Answer

Bon j'ai finalement cherché sur le reste du forum comment utiliser Vundo Fixer....
Il semble que tout soit rentré dans l'ordre!
Je vous remercie enormement... Si il vous semble necessaire que je poste un dernier compte rendu de scan alors je peux le faire.
Merci a vous.

hafedfree1981 · Answer

Bonjour 

tout d'abord je m'excuse pour mon absence, donc j'avait pas suivi la chronologie avec vous c'est vraiment dommage.

maintenant il me semble que cette infection elles est bien maîtrisée et neutralisée, maintenant si vous avez le temps j'aimerai avoir les deux rapport de scan soit celui de l'Avira soit le TR/vundo remover.

en ce qui concerne votre bureau quant à sa disparition, c'est normal, à chaque fois que vous vous trouviez ds telle situation essayer de procéder comme suit :

ctrl + alt + suppr   puis pointez l'onglet des application ensuite nouvelle tâche puis rechercher ce fichier :
C:\WINDOWS\explorer.exe puis valider par ok.

maintenant ,essayer de maintenir votre pc en utilsant Ccleaner comme il était déja signalé par Ajbol, il y a d'autres outils comme le Tunup.  

je suis disponible pour vos interrogations
Bon courage

kl3m1 · Answer

Voila la derniere analyse Avira... Pour les infos sans le bureau je vous remercie mais je m'en étais sorti de cette facon.

Avira AntiVir Personal
Report file date: mercredi 30 avril 2008  16:10

Scanning for 1244897 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    GOMBEAUD

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.197     1260032 Bytes  22/04/2008 11:32:01
ANTIVIR3.VDF  : 7.0.3.232      234496 Bytes  30/04/2008 11:32:02
Engineversion : 8.1.0.37  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.28       233851 Bytes  30/04/2008 11:32:09
AESCN.DLL     : 8.1.0.15       119157 Bytes  30/04/2008 11:32:08
AERDL.DLL     : 8.1.0.20       418165 Bytes  30/04/2008 11:32:08
AEPACK.DLL    : 8.1.1.4        364918 Bytes  30/04/2008 11:32:06
AEOFFICE.DLL  : 8.1.0.18       192890 Bytes  30/04/2008 11:32:05
AEHEUR.DLL    : 8.1.0.21      1196407 Bytes  30/04/2008 11:32:05
AEHELP.DLL    : 8.1.0.14       115063 Bytes  30/04/2008 11:32:04
AEGEN.DLL     : 8.1.0.18       299381 Bytes  30/04/2008 11:32:03
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.27       168310 Bytes  30/04/2008 11:32:03
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercredi 30 avril 2008  16:10

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'MSN Pictures Displayer.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'DSLMON.exe' - '1' Module(s) have been scanned
Scan process 'CoreCenter.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'Core.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'LowLight.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'Domino.exe' - '1' Module(s) have been scanned
Scan process 'ZSSnp211.exe' - '1' Module(s) have been scanned
Scan process 'PSPAP.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmon.exe' - '1' Module(s) have been scanned
Scan process 'DAP.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmgr.exe' - '1' Module(s) have been scanned
Scan process 'LogiTray.exe' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'DrgToDsc.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'libusbd-nt.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
71 processes with 71 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '47' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{CAD93D76-CD68-4F37-95E9-769ECD1AB769}\RP777\A0154393.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was moved to '484989f3.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!


End of the scan: mercredi 30 avril 2008  17:19
Used time:  1:08:57 min

The scan has been done completely.

   7822 Scanning directories
 326537 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 326536 Files not concerned
   3128 Archives were scanned
      2 Warnings
      1 Notes

hafedfree1981 · Answer

salut

C:\System Volume Information\_restore{CAD93D76-CD68-4F37-95E9-769ECD1AB769}\RP777\A0154393.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen, le trojan a été déplacé en quarantine mais  toujours présent dans votre disque juste dans le système volume information. (système de restauration et mise en sauvegarde )

fais un clic droit sur le volume C:\ -----> propriétés -----> nettoyage de disque
puis choisis l'onglet  Autres options -------> Nettoyer de restauration , excuter ce nettoyage
ça va supprimer les fichiers inutiles dans le volume system information.
refais l'analyse

sandc-love · Answer

bonjour, je ne sais pas si je me trouve dans la bonne discussion mais j'ai peur car j'ai eu un problème... voila mon ordinateur affiche une page bleue que je sais résoudre normalement mais la c'est différent! ca me met " STOP: c000021a
{erreur systeme irrecuperable}
0xc0000005 (0x7c906c3 0x0052f06c) ...etc
merci de vos réponses

Virus?

27 réponses

Votre réponse

Discussions similaires

Newsletters