Infection win32.virtumondeRésolu/Fermé

Question

Bonjour,

Etant victime d'affichage intempestif de fenetre pubicitaire me proposant des scan en ligne, j'ai fait une analyse complete de mon systeme avec AVG anti-spyware, qui m'a detecter une effection de ce "virtumonde".
Inutile de preciser, que même si AVG l'a détcter, il ne l'a bien entendu pas suprimer (malheureusement).

Donc apres quelques recherche sur le net, j'ai utiliser le programme VUNDOFIX qui qand a lui ne l'a pas détecter du tout :-(

Donc je serais extremement reconnaissant envers qui que ce soit pouvant m'aider a éradiquer ce foutu machin.

Merci par avance...

jlpjlp · Answer

slt,




virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

_____________


télécharge combofix (par sUBs) ici : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

et enregistre le sur le bureau. 

déconnecte toi d'internet et ferme toutes tes applications. 

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware) 


double-clique sur combofix.exe et suis les instructions 

à la fin, il va produire un rapport C:\ComboFix.txt 

réactive ton parefeu, ton antivirus, la garde de ton antispyware 

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse. 

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. 

Tu as un tutoriel complet ici : 

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix 


_____________

colle un rapport hijackthis 
 

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :
http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."

Utilisateur anonyme · Answer

Un grand merci a toi pour preter attention a mon probleme. j'ais donc effectuer ce que tu m'a conseiiler, et voici donc les rapport : ( a savoir, j'ai beien tout désactiver avnt de proceder, cependant j'ai oublier que AVG redemarai automatiquement apres le reboot de la machine^^) [06/13/2008, 15:34:15] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Greg\Bureau\VirtumundoBeGone.exe" ) [06/13/2008, 15:34:22] - User choose NOT to continue. Exiting... [06/13/2008, 15:40:37] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Greg\Bureau\VirtumundoBeGone.exe" ) [06/13/2008, 15:40:48] - Detected System Information: [06/13/2008, 15:40:48] - Windows Version: 5.1.2600, Service Pack 2 [06/13/2008, 15:40:48] - Current Username: Greg (Admin) [06/13/2008, 15:40:48] - Windows is in NORMAL mode. [06/13/2008, 15:40:48] - Searching for Browser Helper Objects: [06/13/2008, 15:40:48] - BHO 1: {3DEAFCDF-F4D6-4866-9474-5F9765779D7E} () [06/13/2008, 15:40:48] - WARNING: BHO has no default name. Checking for Winlogon reference. [06/13/2008, 15:40:48] - No filename found. Continuing. [06/13/2008, 15:40:48] - BHO 2: {59E8741F-0A31-43D4-815F-54CBD3EBDBFF} () [06/13/2008, 15:40:48] - WARNING: BHO has no default name. Checking for Winlogon reference. [06/13/2008, 15:40:48] - Checking for HKLM\...\Winlogon\Notify\urqNGyWQ [06/13/2008, 15:40:48] - Key not found: HKLM\...\Winlogon\Notify\urqNGyWQ, continuing. [06/13/2008, 15:40:48] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class) [06/13/2008, 15:40:48] - BHO 4: {81EA3F36-357A-435A-8741-52C27CCC9F21} () [06/13/2008, 15:40:48] - WARNING: BHO has no default name. Checking for Winlogon reference. [06/13/2008, 15:40:48] - No filename found. Continuing. [06/13/2008, 15:40:48] - BHO 5: {a4a75d6c-2c35-4fef-a9da-a4c5f61b840d} () [06/13/2008, 15:40:48] - WARNING: BHO has no default name. Checking for Winlogon reference. [06/13/2008, 15:40:48] - Checking for HKLM\...\Winlogon\Notify\olcetccr [06/13/2008, 15:40:48] - Key not found: HKLM\...\Winlogon\Notify\olcetccr, continuing. [06/13/2008, 15:40:48] - Finished Searching Browser Helper Objects [06/13/2008, 15:40:48] - Finishing up... [06/13/2008, 15:40:49] - Nothing found! Exiting... ComboFix 08-06-11.7 - Greg 2008-06-13 15:42:09.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.652 [GMT 2:00] Endroit: C:\Documents and Settings\Greg\Bureau\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM2f5f27c9.xml C:\WINDOWS\cookies.ini C:\WINDOWS\Fonts\CALIBRIB.TTF C:\WINDOWS\pskt.ini C:\WINDOWS\system32\bxuvrssi.ini C:\WINDOWS\system32\cgkhumkq.ini C:\WINDOWS\system32\imscadng.dll C:\WINDOWS\system32\issrvuxb.dll C:\WINDOWS\system32\olcetccr.dll C:\WINDOWS\system32\pskill.exe C:\WINDOWS\system32\qedobckf.ini C:\WINDOWS\system32\QWyGNqru.ini C:\WINDOWS\system32\QWyGNqru.ini2 C:\WINDOWS\system32\ujeswtth.ini C:\WINDOWS\system32\urqNGyWQ.dll C:\WINDOWS\system32\XFgMoUvw.ini C:\WINDOWS\system32\XFgMoUvw.ini2 . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-13 to 2008-06-13 )))))))))))))))))))))))))))))))))))) . 2008-06-13 15:39 . 2008-06-13 15:39 d-------- C:\hijackthis 2008-06-13 15:10 . 2008-06-13 15:10 d-------- C:\VundoFix Backups 2008-06-13 14:31 . 2008-06-13 14:31 d-------- C:\Documents and Settings\Greg\Application Data\Grisoft 2008-06-13 14:31 . 2008-06-13 14:31 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-06-13 14:31 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-06-13 13:51 . 2008-06-13 14:35 d-------- C:\Program Files\Unlocker 2008-06-13 12:58 . 2008-06-13 12:58 d-------- C:\WINDOWS\system32\VIRepair 2008-06-12 17:53 . 2008-06-12 19:43 d-------- C:\Program Files\uTorrent 2008-06-12 17:53 . 2008-06-13 15:39 d-------- C:\Documents and Settings\Greg\Application Data\uTorrent 2008-06-12 16:04 . 2008-06-12 16:04 d-------- C:\Documents and Settings\Greg\Application Data\Yahoo! 2008-06-12 14:34 . 2008-06-12 14:34 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-06-12 14:33 . 2008-06-13 13:03 d-------- C:\Program Files\Yahoo! 2008-06-12 11:08 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-06-12 09:28 . 2008-06-12 10:18 d-------- C:\Documents and Settings\Greg\Application Data\SoftMaker 2008-06-11 12:58 . 2008-06-11 12:58 d-------- C:\Program Files\MySQL 2008-06-11 12:37 . 2008-06-11 12:37 d-------- C:\Program Files\Fichiers communs\Adobe 2008-06-11 10:58 . 2008-06-11 10:58 76,214 --a------ C:\WINDOWS\Icon_4.ico 2008-06-11 10:30 . 2008-06-11 10:30 76,214 --a------ C:\WINDOWS\Icon_3.ico 2008-06-11 10:14 . 2008-06-11 10:14 78,942 --a------ C:\WINDOWS\Icon_2.ico 2008-06-11 09:13 . 2008-06-11 09:13 d-------- C:\Program Files\Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter 2008-06-11 09:13 . 2005-07-13 16:38 81,920 --a------ C:\WINDOWS\system32\ZDPN50.dll 2008-06-11 09:13 . 2005-07-13 16:38 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.sys 2008-06-10 22:21 . 2008-06-10 22:22 159 --a------ C:\WINDOWS\system\Cmicnfg3.ini 2008-06-10 22:20 . 2008-06-10 22:20 d-------- C:\Program Files\C-Media PCI Audio 2008-06-10 22:20 . 2004-08-16 13:17 2,498,560 -ra------ C:\WINDOWS\system\CMICNFG3.CPL 2008-06-10 22:20 . 2004-08-16 13:17 917,504 -ra------ C:\WINDOWS\system\CMDS3D3.DLL 2008-06-10 22:20 . 2004-08-16 13:17 798,592 -ra------ C:\WINDOWS\system32\drivers\cmuda3.sys 2008-06-10 22:20 . 2004-08-16 13:17 712,704 -ra------ C:\WINDOWS\system32\AUDIO3D3.DLL 2008-06-10 22:20 . 2004-08-16 13:17 712,704 -ra------ C:\WINDOWS\system32\a3d.dll 2008-06-10 22:20 . 2004-08-16 13:17 233,472 -ra------ C:\WINDOWS\system32\CMRMDRV3.exe 2008-06-10 22:20 . 2004-08-16 13:17 36,864 -ra------ C:\WINDOWS\system32\CMUDA3.DLL 2008-06-10 22:20 . 2004-08-16 13:17 32,768 -ra------ C:\WINDOWS\system32\UDAPROP3.DLL 2008-06-10 22:20 . 2004-08-16 13:17 28,672 -ra------ C:\WINDOWS\system32\CMRMDRV3.DLL 2008-06-10 22:20 . 2004-08-16 13:16 28,672 -r------- C:\WINDOWS\CmiPCIUninstall.exe 2008-06-10 22:19 . 2008-06-10 22:19 92 --a------ C:\WINDOWS\CMISETUP.INI 2008-06-10 22:19 . 2008-06-10 22:19 26 --a------ C:\WINDOWS\CMCDPLAY.INI 2008-06-10 22:17 . 2008-06-10 22:17 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_HDJAsioK_01005.Wdf 2008-06-10 22:16 . 2008-04-15 12:10 131,456 --a------ C:\WINDOWS\system32\drivers\HDJAsioK.sys 2008-06-10 22:16 . 2008-06-02 11:48 82,304 --a------ C:\WINDOWS\system32\drivers\HDJMidi.sys 2008-06-10 22:16 . 2008-01-25 12:37 73,728 --a------ C:\WINDOWS\system32\HDJAsioCpl.dll 2008-06-10 22:16 . 2008-05-07 13:56 54,784 --a------ C:\WINDOWS\system32\HDJAsiou.dll 2008-06-10 22:16 . 2004-08-19 16:00 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2008-06-10 22:16 . 2004-08-19 16:00 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-06-10 22:16 . 2008-06-10 22:16 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-06-10 22:16 . 2008-06-10 22:16 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_HDJBulk_01005.Wdf 2008-06-10 22:15 . 2006-11-02 08:09 1,419,232 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll 2008-06-10 22:15 . 2008-01-23 12:24 29,312 --a------ C:\WINDOWS\system32\drivers\HDJBulk.sys 2008-06-10 22:14 . 2008-06-10 22:14 d-------- C:\Program Files\Hercules 2008-06-10 22:14 . 2008-06-10 22:14 d-------- C:\Program Files\Guillemot 2008-06-10 22:14 . 2008-06-10 22:14 d-------- C:\Documents and Settings\Greg\Application Data\InstallShield 2008-06-10 22:14 . 2008-05-26 15:19 188,416 --a------ C:\WINDOWS\system32\HDJAPI.dll 2008-06-10 22:14 . 2008-05-26 15:19 106,496 --a------ C:\WINDOWS\system32\HRFDongle.dll 2008-06-10 22:14 . 2007-11-06 17:52 102,400 --a------ C:\WINDOWS\system32\HDJSeries.cpl 2008-06-10 22:14 . 2008-01-25 12:31 80,384 --a------ C:\WINDOWS\system32\HerculesDJDevices.dll 2008-06-10 22:14 . 2008-04-28 11:29 27,136 --a------ C:\WINDOWS\system32\HDJSAPI.dll 2008-06-10 22:04 . 2008-06-10 22:05 d-------- C:\Program Files\Numark Cue 2008-06-10 21:08 . 2008-06-10 21:15 d-------- C:\Program Files\SHOUTcast 2008-06-10 20:10 . 2008-06-13 13:03 d-------- C:\Program Files\SpacialAudio 2008-06-10 19:08 . 2008-06-10 19:08 d-------- C:\Documents and Settings\All Users\Application Data\MySQL 2008-06-10 14:27 . 2004-08-19 16:10 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax 2008-06-10 14:05 . 2008-06-10 14:05 d-------- C:\WINDOWS\Downloaded Installations 2008-06-10 13:57 . 2008-06-10 13:57 d-------- C:\WINDOWS\Sun 2008-06-10 12:55 . 2008-06-10 12:55 d-------- C:\Documents and Settings\Greg\Application Data\vlc 2008-06-10 12:36 . 2008-06-10 12:36 d-------- C:\Program Files\Icecast2 Win32 2008-06-10 12:02 . 2008-06-10 12:02 d-------- C:\Program Files\Fichiers communs\Logitech 2008-06-10 12:00 . 2008-06-10 12:02 d-------- C:\Program Files\Logitech 2008-06-10 11:37 . 2008-06-10 11:42 d-------- C:\Program Files\jv16 PowerTools 2008 2008-06-10 10:17 . 2008-06-10 10:17 d-------- C:\Documents and Settings\Greg\Application Data\Todae 2008-06-10 10:11 . 2008-06-12 12:07 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-06-10 10:11 . 2008-06-12 12:07 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-06-10 10:10 . 2008-06-10 10:10 d-------- C:\Program Files\Kaspersky Lab 2008-06-10 10:10 . 2008-06-13 13:59 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-06-10 10:10 . 2008-06-13 15:43 1,648,672 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-10 10:10 . 2008-06-13 15:43 393,248 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-06-10 10:10 . 2008-06-13 15:43 13,960 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-10 10:10 . 2008-06-13 15:43 2,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-06-10 10:09 . 2008-06-10 10:09 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-06-10 00:06 . 2008-06-10 00:06 d-------- C:\Documents and Settings\Greg\Application Data\ViStart 2008-06-10 00:03 . 2008-06-10 00:03 d-------- C:\Documents and Settings\Greg\Application Data\Styler 2008-06-10 00:02 . 2008-06-11 11:02 d-------- C:\Program Files\WinFlip 2008-06-10 00:02 . 2008-06-11 11:02 d-------- C:\Program Files\TrueTransparency 2008-06-10 00:02 . 2008-06-13 12:58 d-------- C:\Program Files\Styler 2008-06-09 23:54 . 2008-06-09 23:54 78,942 --a------ C:\WINDOWS\Icon_1.ico 2008-06-09 23:53 . 2008-06-13 12:59 d-------- C:\WINDOWS\system32\VITrans 2008-06-09 23:53 . 2008-06-11 11:03 d-------- C:\VTPFiles 2008-06-09 23:53 . 2006-12-03 17:15 111,104 --a------ C:\WINDOWS\system32\Uharc.exe 2008-06-09 23:53 . 2006-12-03 17:15 69,632 --a------ C:\WINDOWS\system32\moveex.exe 2008-06-09 23:53 . 2006-12-03 17:15 19,968 --a------ C:\WINDOWS\system32 eico.exe 2008-06-09 23:53 . 2006-12-03 17:14 8,636 --a------ C:\WINDOWS\system32\modifype.exe 2008-06-09 22:13 . 2008-06-09 22:18 d-------- C:\Program Files\Winamp 2008-06-09 22:13 . 2008-06-09 22:18 d-------- C:\Documents and Settings\Greg\Application Data\Winamp 2008-06-09 21:48 . 2008-06-10 23:17 d-------- C:\Documents and Settings\Greg\Application Data\LimeWire 2008-06-09 21:48 . 2008-06-13 12:50 171 --a------ C:\WINDOWS\icecast2.ini 2008-06-09 21:47 . 2008-06-10 00:16 d-------- C:\Program Files\Java 2008-06-09 21:47 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-09 21:45 . 2008-06-09 21:57 d-------- C:\Program Files\LimeWire 2008-06-09 21:45 . 2008-06-09 21:45 d-------- C:\Program Files\Fichiers communs\Java 2008-06-09 21:29 . 2008-06-09 21:29 d-------- C:\Program Files\MSBuild 2008-06-09 21:29 . 2008-06-09 21:29 d-------- C:\Program Files\Microsoft Works 2008-06-09 21:24 . 2008-06-09 21:28 d-------- C:\WINDOWS\SHELLNEW 2008-06-09 21:23 . 2008-06-09 21:35 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-09 21:22 . 2008-06-09 21:22 dr-h----- C:\MSOCache 2008-06-09 21:06 . 2008-06-09 21:06 d-------- C:\Program Files\VirtualDJ 2008-06-09 18:30 . 2006-10-04 16:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-06-09 18:30 . 2006-10-04 16:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-06-09 18:30 . 2006-10-04 16:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb 2008-06-09 18:28 . 2008-06-09 18:28 d-------- C:\Program Files\Windows Media Connect 2 2008-06-09 18:21 . 2008-06-09 18:21 d-------- C:\WINDOWS\system32\LogFiles 2008-06-09 18:21 . 2008-06-09 18:24 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-06-09 16:27 . 2008-06-09 16:28 d-------- C:\WINDOWS\system32\fr-fr 2008-06-09 16:24 . 2008-06-09 16:24 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2008-06-09 16:23 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll 2008-06-09 16:21 . 2008-06-09 16:25 5,415 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-06-09 16:12 . 2008-06-09 19:02 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-06-09 16:11 . 2008-06-10 10:07 d-------- C:\WINDOWS\Internet Logs 2008-06-09 16:02 . 2008-06-09 16:06 d-------- C:\Program Files\BitComet 2008-06-09 16:02 . 2008-06-12 20:50 d-------- C:\Downloads 2008-06-09 16:02 . 2008-06-09 16:02 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2008-06-09 14:59 . 2008-06-09 14:59 d-------- C:\Program Files\7-Zip 2008-06-09 14:58 . 2008-06-09 16:25 72,234 --a------ C:\WINDOWS\BricoPackUninst.cmd 2008-06-09 14:57 . 2008-06-09 16:21 d-------- C:\WINDOWS\BricoPacks 2008-06-09 14:57 . 2008-06-09 16:30 d--h----- C:\WINDOWS\$hf_mig$ 2008-06-09 14:55 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-06-09 14:55 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-06-09 14:55 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-12 08:18 --------- d-----w C:\Program Files\Ashampoo 2008-06-11 07:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-11 07:13 --------- d-----w C:\Program Files\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter 2008-06-09 13:42 --------- d-----w C:\Program Files\Lavasoft 2008-06-09 13:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-09 13:36 --------- d-----w C:\Program Files\SpywareBlaster 2008-06-09 13:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-09 13:20 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-06-09 13:20 --------- d-----w C:\Program Files\Windows Live 2008-06-09 13:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-06-09 13:02 --------- d-----w C:\Program Files\Opera 2008-06-09 13:01 --------- d-----w C:\Program Files\VideoLAN 2008-06-09 12:26 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2008-06-09 11:53 --------- d-----w C:\Program Files\S3 2008-06-09 11:51 --------- d-----w C:\Program Files\VIA 2008-06-09 11:51 --------- d-----w C:\Program Files\Realtek 2008-06-09 11:49 --------- d-----w C:\Program Files\DIFX 2008-06-09 11:37 558,142 ----a-w C:\WINDOWS\java\Packages\PBLBZJ5F.ZIP 2008-06-09 11:37 155,995 ----a-w C:\WINDOWS\java\Packages\DR7XZDBJ.ZIP 2008-06-09 11:37 --------- d-----w C:\Program Files\microsoft frontpage 2008-06-09 11:35 --------- d-----w C:\Program Files\Services en ligne 2008-04-25 16:21 26,964 ----a-w C:\WINDOWS\system32\drivers\klopp.dat 2008-04-16 12:23 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys . ------- Sigcheck ------- 2005-03-02 20:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINDOWS\$hf_mig$\KB890859\SP2QFE tkrnlpa.exe 2007-02-28 18:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINDOWS\$hf_mig$\KB931784\SP2QFE tkrnlpa.exe 2002-09-07 02:00 1951488 4560381fa3425b16f5df1a0de4814de7 C:\WINDOWS\$NtServicePackUninstall$ tkrnlpa.exe 2004-08-19 16:04 2058880 f252fae094c54572ece38a039f2103c4 C:\WINDOWS\$NtUninstallKB890859$ tkrnlpa.exe 2005-03-02 20:07 2058880 73fa9c95d235844a36968c7852c7dbdd C:\WINDOWS\$NtUninstallKB931784$ tkrnlpa.exe 2007-02-28 18:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\Driver Cache\i386 tkrnlpa.exe 2004-08-19 16:04 2058880 f252fae094c54572ece38a039f2103c4 C:\WINDOWS\ServicePackFiles\i386 tkrnlpa.exe 2005-03-02 20:07 2058880 73fa9c95d235844a36968c7852c7dbdd C:\WINDOWS\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2gdr tkrnlpa.exe 2005-03-02 20:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINDOWS\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2qfe tkrnlpa.exe 2007-02-28 18:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\sp2gdr tkrnlpa.exe 2007-02-28 18:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINDOWS\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\sp2qfe tkrnlpa.exe 2007-02-28 18:02 2070016 7763b6795be99a28a4b52eabdf8968a6 C:\WINDOWS\system32 tkrnlpa.exe 2007-02-28 18:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\system32\dllcache tkrnlpa.exe 2005-03-02 20:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINDOWS\$hf_mig$\KB890859\SP2QFE toskrnl.exe 2007-02-28 18:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE toskrnl.exe 2002-09-07 02:00 2045824 f58b3ce36566d6061a496dc595a8aaa3 C:\WINDOWS\$NtServicePackUninstall$ toskrnl.exe 2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 C:\WINDOWS\$NtUninstallKB890859$ toskrnl.exe 2005-03-02 20:08 2181376 63729dd0f2aae36cc52b89c05505146c C:\WINDOWS\$NtUninstallKB931784$ toskrnl.exe 2007-02-28 18:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\Driver Cache\i386 toskrnl.exe 2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 C:\WINDOWS\ServicePackFiles\i386 toskrnl.exe 2005-03-02 20:08 2181376 63729dd0f2aae36cc52b89c05505146c C:\WINDOWS\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2gdr toskrnl.exe 2005-03-02 20:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINDOWS\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2qfe toskrnl.exe 2007-02-28 18:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\sp2gdr toskrnl.exe 2007-02-28 18:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINDOWS\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\sp2qfe toskrnl.exe 2007-02-28 18:02 2192768 294f49bbd9adc02f1c456eec8ffb05bf C:\WINDOWS\system32 toskrnl.exe 2007-02-28 18:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\system32\dllcache toskrnl.exe 2007-06-13 15:22 1435136 622c00f6c2e3f78c7a957a27c75dfa1b C:\WINDOWS\explorer.exe 2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2002-09-07 02:00 1008128 82fe0d400cb1ac937234467b927b867a C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-08-19 16:09 978432 c2e06cb7cfb5dbd8767ddd5e2e18cf71 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2007-06-13 15:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2gdr\explorer.exe 2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\sp2qfe\explorer.exe 2007-06-13 15:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\system32\dllcache\explorer.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au] "NoAutoUpdate"= 1 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\awtRjgHX] awtRjgHX.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify qRHApqP] rqRHApqP.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Opera\Opera.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\BitComet\BitComet.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\French\setup.exe"= "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"= "C:\Program Files\Yahoo!\Messenger\YServer.exe"= "C:\Program Files\uTorrent\uTorrent.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12902:TCP"= 12902:TCP:BitComet 12902 TCP "12902:UDP"= 12902:UDP:BitComet 12902 UDP "3306:TCP"= 3306:TCP:MySQL Server "8170:TCP"= 8170:TCP:BitComet 8170 TCP "8170:UDP"= 8170:UDP:BitComet 8170 UDP "8931:TCP"= 8931:TCP:BitComet 8931 TCP "8931:UDP"= 8931:UDP:BitComet 8931 UDP R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 13:38] R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 13:39] R3 Bulk;HDJBulk;C:\WINDOWS\system32\Drivers\HDJBulk.sys [2008-01-23 12:24] R3 HDJAsioK;HDJAsioK;C:\WINDOWS\system32\Drivers\HDJAsioK.sys [2008-04-15 12:10] R3 HDJMidi;Hercules DJ Console MIDI;C:\WINDOWS\system32\DRIVERS\HDJMidi.sys [2008-06-02 11:48] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 19:02] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2006-11-10 04:06] S3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\System32\ZDCndis5.SYS [] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-13 15:45:07 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe . ************************************************************************** . Temps d'accomplissement: 2008-06-13 15:46:40 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-13 13:46:37 Pre-Run: 133,365,407,744 octets libres Post-Run: 133,330,264,064 octets libres 296 --- E O F --- 2008-06-09 16:00:21 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:47:51, on 13/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe C:\WINDOWS\explorer.exe C:\hijackthis\eden.exe.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet ools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: awtRjgHX - awtRjgHX.dll (file missing) O20 - Winlogon Notify: rqRHApqP - rqRHApqP.dll (file missing) O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: awtRjgHX - awtRjgHX.dll (file missing)
O20 - Winlogon Notify: rqRHApqP - rqRHApqP.dll (file missing)

_______________

encore des pubs? des alertes....????

Utilisateur anonyme · Answer

Et bien non, il semblerais que le probleme soit résolu, et je t'en remerci énormement ;-)

cependant, j'aurais juste une derniere question :
j'utilise 3 navigateur sur ma machine, i-explorer , opera, et mozilla.
Et toutes ces publicitées n'aparaissait seulment que quand j'utilise i-explorer.

Saurais tu me dire pourquoi ca n'arrivai pas avec les autres ?

jlpjlp · Answer

internet explorer est plus touché par les concepteurs de virus
il est preferable de naviguer avec les autres




vire

virtumondebegone, hijakchits et combofix de ton ordinateur

bonne suite

Utilisateur anonyme · Answer

Ok , Message bien recu ;-) 

Encor merci a toi !!

jlpjlp · Answer

de rien bonne suite

Infection win32.virtumonde

7 réponses

Discussions similaires

Newsletters