TR/Monder: worm ou pas ??? très urgent !!! Fermé

Question

Bonjour tout le monde !! j'ai un gros gros problème de virus.... j'ai antivirr comme programme, mais çà n'a pas l'air très efficace, et là, le virus est entrain de s'attaquer à tout ce qui est fichier dll, du coup, je ne sais pas si çà ne sera pas irréversible.... j'ai vraiment besoin d'un coup de main...... j'ai déjà mis un topic là-dessus, mais pas de réponse... donc je recommence.... voici le rapport que j'ai par antivirr : Avira AntiVir Personal Report file date: samedi 24 mai 2008 10:29 Scanning for 1285666 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: EZ3KIEL-C4585D4 Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 25/04/2008 13:35:16 AVSCAN.DLL : 8.1.1.0 53505 Bytes 25/04/2008 13:35:16 LUKE.DLL : 8.1.2.9 151809 Bytes 25/04/2008 13:35:16 LUKERES.DLL : 8.1.2.1 12033 Bytes 25/04/2008 13:35:16 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:36:52 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 23:06:53 ANTIVIR2.VDF : 7.0.4.53 1848832 Bytes 17/05/2008 14:09:02 ANTIVIR3.VDF : 7.0.4.84 148480 Bytes 23/05/2008 14:05:19 Engineversion : 8.1.0.46 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/04/2008 13:35:17 AESCRIPT.DLL : 8.1.0.33 266618 Bytes 16/05/2008 14:07:10 AESCN.DLL : 8.1.0.18 119156 Bytes 16/05/2008 14:07:09 AERDL.DLL : 8.1.0.20 418165 Bytes 25/04/2008 13:35:17 AEPACK.DLL : 8.1.1.5 364918 Bytes 16/05/2008 14:07:08 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 25/04/2008 13:35:17 AEHEUR.DLL : 8.1.0.29 1253750 Bytes 16/05/2008 14:07:06 AEHELP.DLL : 8.1.0.14 115063 Bytes 25/04/2008 13:35:17 AEGEN.DLL : 8.1.0.21 303477 Bytes 16/05/2008 14:06:54 AEEMU.DLL : 8.1.0.6 430451 Bytes 08/05/2008 14:05:52 AECORE.DLL : 8.1.0.29 168311 Bytes 16/05/2008 14:06:51 AVWINLL.DLL : 1.0.0.7 14593 Bytes 25/04/2008 13:35:16 AVPREF.DLL : 8.0.0.1 25857 Bytes 25/04/2008 13:35:15 AVREP.DLL : 7.0.0.1 155688 Bytes 21/04/2007 14:45:31 AVREG.DLL : 8.0.0.0 30977 Bytes 25/04/2008 13:35:15 AVARKT.DLL : 1.0.0.23 307457 Bytes 25/04/2008 13:35:15 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 25/04/2008 13:35:15 SQLITE3.DLL : 3.3.17.1 339968 Bytes 25/04/2008 13:35:16 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 25/04/2008 13:35:16 NETNT.DLL : 8.0.0.1 7937 Bytes 25/04/2008 13:35:16 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 25/04/2008 13:35:10 RCTEXT.DLL : 8.0.32.0 86273 Bytes 25/04/2008 13:35:10 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, E:, F:, G:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: samedi 24 mai 2008 10:29 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'SpybotSD.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'WLAN_Service.exe' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'WlanUtility.exe' - '1' Module(s) have been scanned Scan process 'VeohClient.exe' - '1' Module(s) have been scanned Scan process 'QTTask.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'aolsoftware.exe' - '1' Module(s) have been scanned Scan process 'daemon.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'WLanCfgG.exe' - '1' Module(s) have been scanned Scan process 'WLService.exe' - '1' Module(s) have been scanned Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 35 processes with 35 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'E:\' [INFO] No virus was found! Boot sector 'F:\' [INFO] No virus was found! Boot sector 'G:\' [INFO] No virus was found! Starting to scan the registry. C:\WINDOWS\system32\cbXRHaby.dll [DETECTION] Is the Trojan horse TR/Monder.45056.17 [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] The registry was scanned ( '29' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\System Volume Information\_restore{A88B9574-72FF-4FA5-B07E-DA9D764A1277}\RP776\A0266587.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [NOTE] The file was moved to '4869e683.qua'! C:\WINDOWS\system32\cbXRHaby.dll [DETECTION] Is the Trojan horse TR/Monder.45056.17 [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] Begin scan in 'E:\' Begin scan in 'F:\' Begin scan in 'G:\' End of the scan: samedi 24 mai 2008 13:18 Used time: 2:48:50 min The scan has been done completely. 12114 Scanning directories 381900 Files were scanned 3 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 1 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 381897 Files not concerned 1677 Archives were scanned 3 Warnings 1 Notes et voici celui de hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:08:52, on 24/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\sndvol32.exe C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fmsger%2ftabs%2f_pictos%2fcoca%2fPictoCoke02.png%3f R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {FA8BE6D5-40E0-48B8-B317-18A4A590918A} - C:\WINDOWS\system32\cbXRHaby.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins eg\VeohToolbar.dll O4 - HKLM\..\Run: [PMXInit] C:\WINDOWS\system32\pmxinit.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1161628436\ee\AOLSoftware.exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Fichiers communs\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [Configuration de la C-BOX] C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Banshee Screamer Alarm.lnk = C:\Program Files\Banshee Screamer Alarm\alarm.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WlanUtility.lnk = C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32 wprovau.dll O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://jiogihirr.spaces.live.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,4973/mcfscan.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O20 - Winlogon Notify: cbXRHaby - C:\WINDOWS\SYSTEM32\cbXRHaby.dll O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O24 - Desktop Component 0: (no name) - http://farm2.static.flickr.com/1264/583840813_0e8553e2bb_m.jpg

dou-l · Answer

salut,,,,


télécharge GenProc http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip sur ton bureau

dézippe le dossier, double-clique sur GenProc.bat et poste le contenu du rapport qui s'ouvre

Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html

Tsume · Answer

GenProc 1.966 [1] 24/05/2008 - Windows [XP] : Aucune infection caractéristique trouvée  

oki merci, mais parcontre, qu'est ce qu'il traite comme type de virus, parce que même après avoir fait le test, je reçois encore ces alerte émanant de mon anti-virus......

qu'est ce que je peux faire de plus ???

et par rapport à ce que j'ai mis (rapport antivirr et hijackthis), est ce qu'il y a des trucs à faire ???

dou-l · Answer

Fais un scan avec cet antimalware :

Telecharge malwarebytes https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

dou-l · Answer

Tu n'as pas fait ce qu'il fallait !!

Recommence en supprimant tout ce qu'il trouve !

dou-l · Answer

Oui c'est bien du vundo comme le rapport MBAM l'indique !

Cette phrase : No action taken. Veut dire que rien n'a etait fait (aucune suppression).

Donc pendant l'analyse des qu'il trouve quelque chose tu le supprimes et tu poste le rapport générer !

a+

dou-l · Answer

A la fin de l'analyse tu fait supprimer la séléction il n'y a pas ??

regarde le tuto : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tsume · Answer

ahhh si !! c'est ce que j'avais fait, mais je veux dire, pendant l'analyse, il n'y a pas de possibilités de quoi que soit, mais à la fin de celle-ci, si ^^ 

désolé pour l'incompréhension....

mais pour vundo.gen, cet anti-malware est efficace ? (juste une question comme çà, parce que je suis un peu stressé par ce virus... çà tombe en plein blocus et examens....)

dou-l · Answer

MBAM est un tres bon outil pour eradiquer vundo !!

Tsume · Answer

bon j'ai fait plusieurs choses : j'ai utilisé l'anti malware : voici le rapport Malwarebytes' Anti-Malware 1.12 Version de la base de données: 783 Type de recherche: Examen complet (C:\|E:\|F:\|G:\|) Eléments examinés: 183065 Temps écoulé: 4 hour(s), 35 minute(s), 54 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 1 Clé(s) du Registre infectée(s): 6 Valeur(s) du Registre infectée(s): 2 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 5 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): C:\WINDOWS\system32\onadhwha.dll (Trojan.Vundo) -> No action taken. Clé(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken. Valeur(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2cf12fb3 (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM2fc21c2f (Trojan.Agent) -> No action taken. Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\WINDOWS\system32\onadhwha.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\ahwhdano.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\yayyWonk.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\knoWyyay.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\xxwwqdvb.dll (Trojan.Agent) -> No action taken. voila ce que çà a fait, ensuite, j'ai débranché internet et j'ai utilisé combofix, dont voici le rapport : ComboFix 08-05-24.1 - EZ3kiel 2008-05-25 17:55:34.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.279 [GMT 2:00] Endroit: C:\Documents and Settings\EZ3kiel\Bureau\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM2fc21c2f.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\jxmfjqym.exe C:\WINDOWS\system32\wl.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-25 to 2008-05-25 )))))))))))))))))))))))))))))))))))) . 2008-05-25 17:26 . 2008-05-25 17:26 d-------- C:\VundoFix Backups 2008-05-24 20:53 . 2008-05-24 20:53 d-------- C:\Documents and Settings\EZ3kiel\Application Data\Malwarebytes 2008-05-24 20:52 . 2008-05-24 20:52 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-24 20:52 . 2008-05-24 20:52 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-24 20:52 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-24 20:52 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-24 19:57 . 2008-05-25 17:46 d-------- C:\registre enregistr‚ 2008-05-24 19:44 . 2008-05-24 19:44 d-------- C:\Program Files\CCleaner 2008-05-24 16:53 . 2008-05-24 16:54 d-------- C:\Program Files\Panda Security 2008-05-22 08:20 . 2008-05-22 08:20 d-------- C:\Program Files\Trend Micro 2008-05-22 06:50 . 2007-03-04 13:55 1,936,528 --a------ C:\WINDOWS\system32\ltmm15.dll 2008-05-22 06:50 . 2008-05-22 06:49 737,280 --a------ C:\WINDOWS\iun6002.exe 2008-05-22 06:50 . 2007-03-04 13:55 135,168 --a------ C:\WINDOWS\system32\DSKernel2.dll 2008-05-22 06:49 . 2008-05-22 06:52 d-------- C:\Program Files\Replay Converter 2008-05-22 06:48 . 2008-05-22 06:49 d-------- C:\Documents and Settings\EZ3kiel\Application Data\GetRightToGo 2008-05-22 06:42 . 2008-05-22 06:42 d-------- C:\Documents and Settings\EZ3kiel\Application Data\AVSMedia 2008-05-22 06:42 . 2008-05-22 06:42 d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU 2008-05-22 06:39 . 2008-05-22 06:45 d-------- C:\Program Files\Fichiers communs\AVSMedia 2008-05-22 06:38 . 2007-02-27 19:36 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2008-05-22 06:38 . 2007-02-27 19:36 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2008-05-22 06:38 . 2007-02-27 19:36 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2008-05-22 06:38 . 2007-02-27 19:36 156,910 --a------ C:\WINDOWS\WMSysPr8.prx 2008-05-22 06:38 . 2007-02-27 19:36 82,944 --a------ C:\WINDOWS\system32\vct3216.acm 2008-05-22 06:38 . 2007-02-27 19:36 53,248 --a------ C:\WINDOWS\system32\xvid.ax 2008-05-22 06:38 . 2007-02-27 19:36 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm 2008-05-22 06:38 . 2007-02-27 19:36 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2008-05-22 06:38 . 2007-02-27 19:36 13,239 --a------ C:\WINDOWS\system32\Scg726.acm 2008-05-22 01:13 . 2008-05-22 06:39 d-------- C:\Program Files\MediaCoder 2008-04-25 00:21 . 2008-04-25 00:21 20,747 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2008-04-25 00:20 . 2008-04-25 00:20 d-------- C:\Program Files\Belkin 2008-04-25 00:20 . 2005-08-02 23:00 232,192 --a------ C:\WINDOWS\system32\drivers\rt73.sys 2008-04-25 00:20 . 2003-10-13 15:30 94,208 --a------ C:\WINDOWS\system32\GTW32N50.dll 2008-04-25 00:20 . 2004-04-30 15:12 40,960 --a------ C:\WINDOWS\system32\B11gUSB.dll 2008-04-25 00:20 . 2003-09-25 23:28 31,930 --a------ C:\WINDOWS\system32\GTNDIS3.VXD 2008-04-25 00:20 . 2003-09-25 22:15 15,872 --a------ C:\WINDOWS\system32\GTNDIS5.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-24 17:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-24 08:27 --------- d-----w C:\Program Files\mIRC 2008-05-22 06:16 --------- d-----w C:\Program Files\QuickTime 2008-04-29 06:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-26 19:08 --------- d-----w C:\Program Files\Cyanide 2008-04-25 16:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic 2008-04-24 22:37 --------- d-----w C:\Program Files\Conquete 2.0 2008-04-24 22:20 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2008-04-08 18:33 --------- d-----w C:\Program Files\TimeAdjuster 2008-04-06 13:43 --------- d-----w C:\Program Files\MicroStar 2005-04-19 17:25 53,323 -c--a-w C:\Program Files\opera\program\plugins\PlugDef.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-04-01 18:35 3587120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PMXInit"="C:\WINDOWS\system32\pmxinit.exe" [2002-05-02 00:00 741447] "Cmaudio"="cmicnfg.cpl" [] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-08-15 04:10 180269] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2005-11-18 01:24 155648] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-25 15:35 262401] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "HostManager"="C:\Program Files\Fichiers communs\AOL\1161628436\ee\AOLSoftware.exe" [2006-05-25 16:35 50760] "IPHSend"="C:\Program Files\Fichiers communs\AOL\IPHSend\IPHSend.exe" [2006-02-17 18:59 124520] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14 270648] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 06:54 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll "VIDC.DIV3"= DivXc32.dll "VIDC.DIV4"= DivXc32f.dll "VIDC.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "msacm.imc"= imc32.acm "VIDC.wmv3"= C:\PROGRA~1\COMBIN~1\Filters\wmv9vcm.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\WINDOWS\system32\dplaysvr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Soulseek\slsk.exe"= "C:\Program Files\mIRC\mirc.exe"= "C:\Program Files\Mozilla Firefox\firefox.exe"= "C:\Program Files\BitTorrent\bittorrent.exe"= "C:\Program Files\AIM\aim.exe"= "C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe"= "C:\Program Files\Fichiers communs\AOL\1161628436\ee\aolsoftware.exe"= "C:\Program Files\Fichiers communs\AOL\1161628436\ee\aim6.exe"= "C:\WINDOWS\system32\sessmgr.exe"= "C:\Program Files\Internet Explorer\IEXPLORE.EXE"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= "C:\Program Files\iTunes\iTunes.exe"= "G:\[ PC Games ] - Age of Empires II(FULL)\age2_x1.exe"= "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"= "F:\Westwood\Nox\GAME.EXE"= R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2008-04-25 15:35] R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2008-04-25 15:35] R3 powervr;powervr;C:\WINDOWS\system32\DRIVERS\powervr.sys [2002-05-02 16:42] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{85ed6a1f-08ea-11dd-9903-000000000000}] \Shell\AutoRun\command - wd_windows_tools\setup.exe . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-05-20 16:37:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2006-12-05 06:15:00 C:\WINDOWS\Tasks\iTunes.job" - C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\iTunes\iTunes.lnk . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-25 18:02:44 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\verclsid.exe . ************************************************************************** . Temps d'accomplissement: 2008-05-25 18:15:45 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-25 16:15:37 Pre-Run: 1,169,707,008 octets libres Post-Run: 1,727,094,784 octets libres 160 --- E O F --- 2008-03-23 17:11:04 ensuite, j'ai regardé par rapport à ce qu'à mis l'anti-malware, et donc apprament il n'y a plus rien, du coup, j'ai réanalysé avec antivirr, juste le DD où il y a windows, puisque ce n'est situé que dans le sytem 32 ou bien dans le registre... voila le rapport : Avira AntiVir Personal Report file date: dimanche 25 mai 2008 18:36 Scanning for 1286436 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: EZ3kiel Computer name: EZ3KIEL-C4585D4 Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 25/04/2008 13:35:16 AVSCAN.DLL : 8.1.1.0 53505 Bytes 25/04/2008 13:35:16 LUKE.DLL : 8.1.2.9 151809 Bytes 25/04/2008 13:35:16 LUKERES.DLL : 8.1.2.1 12033 Bytes 25/04/2008 13:35:16 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:36:52 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 23:06:53 ANTIVIR2.VDF : 7.0.4.53 1848832 Bytes 17/05/2008 14:09:02 ANTIVIR3.VDF : 7.0.4.88 158720 Bytes 25/05/2008 14:07:53 Engineversion : 8.1.0.46 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/04/2008 13:35:17 AESCRIPT.DLL : 8.1.0.33 266618 Bytes 16/05/2008 14:07:10 AESCN.DLL : 8.1.0.18 119156 Bytes 16/05/2008 14:07:09 AERDL.DLL : 8.1.0.20 418165 Bytes 25/04/2008 13:35:17 AEPACK.DLL : 8.1.1.5 364918 Bytes 16/05/2008 14:07:08 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 25/04/2008 13:35:17 AEHEUR.DLL : 8.1.0.29 1253750 Bytes 16/05/2008 14:07:06 AEHELP.DLL : 8.1.0.14 115063 Bytes 25/04/2008 13:35:17 AEGEN.DLL : 8.1.0.21 303477 Bytes 16/05/2008 14:06:54 AEEMU.DLL : 8.1.0.6 430451 Bytes 08/05/2008 14:05:52 AECORE.DLL : 8.1.0.29 168311 Bytes 16/05/2008 14:06:51 AVWINLL.DLL : 1.0.0.7 14593 Bytes 25/04/2008 13:35:16 AVPREF.DLL : 8.0.0.1 25857 Bytes 25/04/2008 13:35:15 AVREP.DLL : 7.0.0.1 155688 Bytes 21/04/2007 14:45:31 AVREG.DLL : 8.0.0.0 30977 Bytes 25/04/2008 13:35:15 AVARKT.DLL : 1.0.0.23 307457 Bytes 25/04/2008 13:35:15 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 25/04/2008 13:35:15 SQLITE3.DLL : 3.3.17.1 339968 Bytes 25/04/2008 13:35:16 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 25/04/2008 13:35:16 NETNT.DLL : 8.0.0.1 7937 Bytes 25/04/2008 13:35:16 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 25/04/2008 13:35:10 RCTEXT.DLL : 8.0.32.0 86273 Bytes 25/04/2008 13:35:10 Configuration settings for the scan: Jobname..........................: Rootkit search Configuration file...............: c:\program files\antivir personaledition classic\rootkit.avp Logging..........................: high Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Scan memory......................: off Process scan.....................: off Scan registry....................: off Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: high Expanded search settings.........: 0x00300922 Start of the scan: dimanche 25 mai 2008 18:36 Starting search for hidden objects. '480656' objects were checked, '0' hidden objects were found. End of the scan: dimanche 25 mai 2008 18:49 Used time: 12:34 min The scan has been done completely. 0 Scanning directories 0 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 0 Files cannot be scanned 0 Files not concerned 0 Archives were scanned 0 Warnings 0 Notes 480656 Objects were scanned with rootkit scan 0 Hidden objects were found et comme tu peux le constater, il n'a rien trouvé ^^ merci beaucoup !!!! je vais attendre un moment de mettre ce topic en résolu, parce que je veux qu'antivirr fasse un le tour avec l'active guard, et après seulement, je le mettrai voilou !!! parcontre, comment on fait pour changer le titre du topic, parce que c'est pas véritablement le sujet de celui-ci.

dou-l · Answer

C'est pas finit je veux verifier un truc !



télécharge OTMoveIt OTMoveit sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,

CITATION  

C:\WINDOWS\system32\onadhwha.dll 
C:\WINDOWS\system32\ahwhdano.ini 
C:\WINDOWS\system32\yayyWonk.dll 
C:\WINDOWS\system32\knoWyyay.ini 
C:\WINDOWS\system32\xxwwqdvb.dll 

et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

TR/Monder: worm ou pas ??? très urgent !!!

10 réponses

Discussions similaires