J'ai tout tenté...please help!!!! vundo...
tanja
-
jorginho67 Messages postés 15447 Statut Contributeur sécurité -
jorginho67 Messages postés 15447 Statut Contributeur sécurité -
Bonjour et Au secours!!!!,
J'ai d'abord essayé de parcourir les reponses pour eviter un post sur un thème déjà abordé, mais je ne suis toujours pas arrivée à me défaire de ce virus -
Voilà ce que j'ai fait:
j'ai d'abord ajouté AntiVir en plus de mon avast (peur que avast ne soit pas bien installé)
J'ai fait un scan vundofix mais il n'a rien trouvé, ensuite j'ai lancé virtumondebegone et voici les résultats:
[07/04/2008, 22:17:02] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\3QVGV10S\VirtumundoBeGone[1].exe" )
[07/04/2008, 22:17:08] - Detected System Information:
[07/04/2008, 22:17:08] - Windows Version: 5.1.2600, Service Pack 2
[07/04/2008, 22:17:08] - Current Username: Compaq_Propriétaire (Admin)
[07/04/2008, 22:17:09] - Windows is in NORMAL mode.
[07/04/2008, 22:17:09] - Searching for Browser Helper Objects:
[07/04/2008, 22:17:09] - BHO 1: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} ()
[07/04/2008, 22:17:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:09] - Checking for HKLM\...\Winlogon\Notify\ljJBrqOH
[07/04/2008, 22:17:09] - Found: HKLM\...\Winlogon\Notify\ljJBrqOH - This is probably Virtumundo.
[07/04/2008, 22:17:09] - Assigning {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} MSEvents Object
[07/04/2008, 22:17:10] - BHO list has been changed! Starting over...
[07/04/2008, 22:17:10] - BHO 1: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} (MSEvents Object)
[07/04/2008, 22:17:10] - ALERT: Found MSEvents Object!
[07/04/2008, 22:17:10] - BHO 2: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:17:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:10] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:17:10] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:17:10] - BHO 3: {9C28EAFB-FF50-4F42-8D39-A006129CC907} ()
[07/04/2008, 22:17:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:10] - Checking for HKLM\...\Winlogon\Notify\jkkJbcCs
[07/04/2008, 22:17:11] - Found: HKLM\...\Winlogon\Notify\jkkJbcCs - This is probably Virtumundo.
[07/04/2008, 22:17:11] - Assigning {9C28EAFB-FF50-4F42-8D39-A006129CC907} MSEvents Object
[07/04/2008, 22:17:11] - BHO list has been changed! Starting over...
[07/04/2008, 22:17:11] - BHO 1: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} (MSEvents Object)
[07/04/2008, 22:17:11] - ALERT: Found MSEvents Object!
[07/04/2008, 22:17:11] - BHO 2: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:17:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:11] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:17:11] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:17:12] - BHO 3: {9C28EAFB-FF50-4F42-8D39-A006129CC907} (MSEvents Object)
[07/04/2008, 22:17:12] - ALERT: Found MSEvents Object!
[07/04/2008, 22:17:12] - BHO 4: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/04/2008, 22:17:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:12] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/04/2008, 22:17:12] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/04/2008, 22:17:12] - Finished Searching Browser Helper Objects
[07/04/2008, 22:17:12] - *** Detected MSEvents Object
[07/04/2008, 22:17:12] - Trying to remove MSEvents Object...
[07/04/2008, 22:17:13] - Terminating Process: IEXPLORE.EXE
[07/04/2008, 22:17:18] - Terminating Process: RUNDLL32.EXE
[07/04/2008, 22:17:20] - Disabling Automatic Shell Restart
[07/04/2008, 22:17:21] - Terminating Process: EXPLORER.EXE
[07/04/2008, 22:18:15] - Suspending the NT Session Manager System Service
[07/04/2008, 22:18:18] - Terminating Windows NT Logon/Logoff Manager
[07/04/2008, 22:18:20] - Re-enabling Automatic Shell Restart
[07/04/2008, 22:18:22] - File to disable: C:\WINDOWS\system32\ljJBrqOH.dll
[07/04/2008, 22:18:22] - Removing HKLM\...\Browser Helper Objects\{1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8}
[07/04/2008, 22:18:23] - Removing HKCR\CLSID\{1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8}
[07/04/2008, 22:18:25] - Adding Kill Bit for ActiveX for GUID: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8}
[07/04/2008, 22:18:26] - Deleting ATLEvents/MSEvents Registry entries
[07/04/2008, 22:18:26] - Removing HKLM\...\Winlogon\Notify\ljJBrqOH
[07/04/2008, 22:18:27] - Searching for Browser Helper Objects:
[07/04/2008, 22:18:27] - BHO 1: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:18:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:27] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:18:27] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:18:27] - BHO 2: {9C28EAFB-FF50-4F42-8D39-A006129CC907} (MSEvents Object)
[07/04/2008, 22:18:27] - ALERT: Found MSEvents Object!
[07/04/2008, 22:18:27] - BHO 3: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/04/2008, 22:18:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:27] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/04/2008, 22:18:27] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/04/2008, 22:18:27] - Finished Searching Browser Helper Objects
[07/04/2008, 22:18:27] - *** Detected MSEvents Object
[07/04/2008, 22:18:27] - Trying to remove MSEvents Object...
[07/04/2008, 22:18:28] - Terminating Process: IEXPLORE.EXE
[07/04/2008, 22:18:28] - Terminating Process: RUNDLL32.EXE
[07/04/2008, 22:18:29] - Disabling Automatic Shell Restart
[07/04/2008, 22:18:29] - Terminating Process: EXPLORER.EXE
[07/04/2008, 22:18:29] - Suspending the NT Session Manager System Service
[07/04/2008, 22:18:30] - Terminating Windows NT Logon/Logoff Manager
[07/04/2008, 22:18:30] - Re-enabling Automatic Shell Restart
[07/04/2008, 22:18:30] - File to disable: C:\WINDOWS\system32\jkkJbcCs.dll
[07/04/2008, 22:18:30] - Removing HKLM\...\Browser Helper Objects\{9C28EAFB-FF50-4F42-8D39-A006129CC907}
[07/04/2008, 22:18:30] - Removing HKCR\CLSID\{9C28EAFB-FF50-4F42-8D39-A006129CC907}
[07/04/2008, 22:18:30] - Adding Kill Bit for ActiveX for GUID: {9C28EAFB-FF50-4F42-8D39-A006129CC907}
[07/04/2008, 22:18:31] - Deleting ATLEvents/MSEvents Registry entries
[07/04/2008, 22:18:31] - Removing HKLM\...\Winlogon\Notify\jkkJbcCs
[07/04/2008, 22:18:31] - Searching for Browser Helper Objects:
[07/04/2008, 22:18:31] - BHO 1: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:18:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:31] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:18:31] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:18:31] - BHO 2: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/04/2008, 22:18:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:31] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/04/2008, 22:18:31] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/04/2008, 22:18:31] - Finished Searching Browser Helper Objects
[07/04/2008, 22:18:31] - Finishing up...
[07/04/2008, 22:18:31] - A restart is needed.
[07/04/2008, 22:18:39] - Attempting to Restart via STOP error (Blue Screen!)
[07/05/2008, 2:39:11] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\3QVGV10S\VirtumundoBeGone[1].exe" )
[07/05/2008, 2:39:19] - Detected System Information:
[07/05/2008, 2:39:19] - Windows Version: 5.1.2600, Service Pack 2
[07/05/2008, 2:39:19] - Current Username: Compaq_Propriétaire (Admin)
[07/05/2008, 2:39:19] - Windows is in NORMAL mode.
[07/05/2008, 2:39:19] - Searching for Browser Helper Objects:
[07/05/2008, 2:39:19] - BHO 1: {A6006408-1AFC-4546-9343-CA1FB40B59A4} ()
[07/05/2008, 2:39:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 2:39:19] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/05/2008, 2:39:19] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/05/2008, 2:39:19] - BHO 2: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/05/2008, 2:39:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 2:39:19] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/05/2008, 2:39:19] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/05/2008, 2:39:19] - Finished Searching Browser Helper Objects
[07/05/2008, 2:39:19] - Finishing up...
[07/05/2008, 2:39:19] - Nothing found! Exiting...
[07/05/2008, 9:02:35] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\3QVGV10S\VirtumundoBeGone[1].exe" )
[07/05/2008, 9:02:41] - Detected System Information:
[07/05/2008, 9:02:41] - Windows Version: 5.1.2600, Service Pack 2
[07/05/2008, 9:02:41] - Current Username: Compaq_Propriétaire (Admin)
[07/05/2008, 9:02:41] - Windows is in NORMAL mode.
[07/05/2008, 9:02:41] - Searching for Browser Helper Objects:
[07/05/2008, 9:02:41] - BHO 1: {30D4FBF3-AAF4-422D-BCEE-B09DA9D6F787} ()
[07/05/2008, 9:02:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 9:02:41] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/05/2008, 9:02:41] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/05/2008, 9:02:41] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[07/05/2008, 9:02:41] - BHO 3: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/05/2008, 9:02:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 9:02:41] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/05/2008, 9:02:41] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/05/2008, 9:02:41] - Finished Searching Browser Helper Objects
[07/05/2008, 9:02:41] - Finishing up...
[07/05/2008, 9:02:41] - Nothing found! Exiting...
[07/06/2008, 9:20:26] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\MO911GGS\VirtumundoBeGone[1].exe" )
[07/06/2008, 9:20:31] - Detected System Information:
[07/06/2008, 9:20:31] - Windows Version: 5.1.2600, Service Pack 2
[07/06/2008, 9:20:31] - Current Username: Compaq_Propriétaire (Admin)
[07/06/2008, 9:20:31] - Windows is in NORMAL mode.
[07/06/2008, 9:20:31] - Searching for Browser Helper Objects:
[07/06/2008, 9:20:31] - BHO 1: {1B502BB3-F095-482C-B62F-72242A916C20} ()
[07/06/2008, 9:20:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/06/2008, 9:20:31] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/06/2008, 9:20:31] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/06/2008, 9:20:31] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[07/06/2008, 9:20:31] - BHO 3: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/06/2008, 9:20:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/06/2008, 9:20:31] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/06/2008, 9:20:31] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/06/2008, 9:20:31] - Finished Searching Browser Helper Objects
[07/06/2008, 9:20:31] - Finishing up...
[07/06/2008, 9:20:31] - Nothing found! Exiting...
ensuite j'ai lancé symantec remove tool: rien trouvé
J'ai après désactivé la restauration du système et ai relancé les scans..même résultats.
QUant à Spybot, il a trouvé dans les 60 'problèmes' mais lorsque je clique sur le bouton 'resoudre les problèmes, tout se fige (sablier) et dans gestionnaire programme: programme ne repond pas.
Je voulais ensuite installer BHO Demon, mais ne l'ai pas trouvé disponible.
Entretemps j'ai désinstallé AntiVir, car les fenêtres qui s'ouvraient tous les deux secondes avec ce Bip nonstop, et ca pendant les 2 jours depuis que j'essaye de mon débarasser du/des virus - j'en pouvais plus...
Si quelqu'un pourrait m'aider? Je ne sais plus quoi faire du tout
MerciConfiguration: Windows XP
J'ai d'abord essayé de parcourir les reponses pour eviter un post sur un thème déjà abordé, mais je ne suis toujours pas arrivée à me défaire de ce virus -
Voilà ce que j'ai fait:
j'ai d'abord ajouté AntiVir en plus de mon avast (peur que avast ne soit pas bien installé)
J'ai fait un scan vundofix mais il n'a rien trouvé, ensuite j'ai lancé virtumondebegone et voici les résultats:
[07/04/2008, 22:17:02] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\3QVGV10S\VirtumundoBeGone[1].exe" )
[07/04/2008, 22:17:08] - Detected System Information:
[07/04/2008, 22:17:08] - Windows Version: 5.1.2600, Service Pack 2
[07/04/2008, 22:17:08] - Current Username: Compaq_Propriétaire (Admin)
[07/04/2008, 22:17:09] - Windows is in NORMAL mode.
[07/04/2008, 22:17:09] - Searching for Browser Helper Objects:
[07/04/2008, 22:17:09] - BHO 1: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} ()
[07/04/2008, 22:17:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:09] - Checking for HKLM\...\Winlogon\Notify\ljJBrqOH
[07/04/2008, 22:17:09] - Found: HKLM\...\Winlogon\Notify\ljJBrqOH - This is probably Virtumundo.
[07/04/2008, 22:17:09] - Assigning {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} MSEvents Object
[07/04/2008, 22:17:10] - BHO list has been changed! Starting over...
[07/04/2008, 22:17:10] - BHO 1: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} (MSEvents Object)
[07/04/2008, 22:17:10] - ALERT: Found MSEvents Object!
[07/04/2008, 22:17:10] - BHO 2: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:17:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:10] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:17:10] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:17:10] - BHO 3: {9C28EAFB-FF50-4F42-8D39-A006129CC907} ()
[07/04/2008, 22:17:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:10] - Checking for HKLM\...\Winlogon\Notify\jkkJbcCs
[07/04/2008, 22:17:11] - Found: HKLM\...\Winlogon\Notify\jkkJbcCs - This is probably Virtumundo.
[07/04/2008, 22:17:11] - Assigning {9C28EAFB-FF50-4F42-8D39-A006129CC907} MSEvents Object
[07/04/2008, 22:17:11] - BHO list has been changed! Starting over...
[07/04/2008, 22:17:11] - BHO 1: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8} (MSEvents Object)
[07/04/2008, 22:17:11] - ALERT: Found MSEvents Object!
[07/04/2008, 22:17:11] - BHO 2: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:17:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:11] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:17:11] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:17:12] - BHO 3: {9C28EAFB-FF50-4F42-8D39-A006129CC907} (MSEvents Object)
[07/04/2008, 22:17:12] - ALERT: Found MSEvents Object!
[07/04/2008, 22:17:12] - BHO 4: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/04/2008, 22:17:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:17:12] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/04/2008, 22:17:12] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/04/2008, 22:17:12] - Finished Searching Browser Helper Objects
[07/04/2008, 22:17:12] - *** Detected MSEvents Object
[07/04/2008, 22:17:12] - Trying to remove MSEvents Object...
[07/04/2008, 22:17:13] - Terminating Process: IEXPLORE.EXE
[07/04/2008, 22:17:18] - Terminating Process: RUNDLL32.EXE
[07/04/2008, 22:17:20] - Disabling Automatic Shell Restart
[07/04/2008, 22:17:21] - Terminating Process: EXPLORER.EXE
[07/04/2008, 22:18:15] - Suspending the NT Session Manager System Service
[07/04/2008, 22:18:18] - Terminating Windows NT Logon/Logoff Manager
[07/04/2008, 22:18:20] - Re-enabling Automatic Shell Restart
[07/04/2008, 22:18:22] - File to disable: C:\WINDOWS\system32\ljJBrqOH.dll
[07/04/2008, 22:18:22] - Removing HKLM\...\Browser Helper Objects\{1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8}
[07/04/2008, 22:18:23] - Removing HKCR\CLSID\{1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8}
[07/04/2008, 22:18:25] - Adding Kill Bit for ActiveX for GUID: {1EB4BF0F-852F-4B75-B8FB-21EDAF9DC3C8}
[07/04/2008, 22:18:26] - Deleting ATLEvents/MSEvents Registry entries
[07/04/2008, 22:18:26] - Removing HKLM\...\Winlogon\Notify\ljJBrqOH
[07/04/2008, 22:18:27] - Searching for Browser Helper Objects:
[07/04/2008, 22:18:27] - BHO 1: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:18:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:27] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:18:27] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:18:27] - BHO 2: {9C28EAFB-FF50-4F42-8D39-A006129CC907} (MSEvents Object)
[07/04/2008, 22:18:27] - ALERT: Found MSEvents Object!
[07/04/2008, 22:18:27] - BHO 3: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/04/2008, 22:18:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:27] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/04/2008, 22:18:27] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/04/2008, 22:18:27] - Finished Searching Browser Helper Objects
[07/04/2008, 22:18:27] - *** Detected MSEvents Object
[07/04/2008, 22:18:27] - Trying to remove MSEvents Object...
[07/04/2008, 22:18:28] - Terminating Process: IEXPLORE.EXE
[07/04/2008, 22:18:28] - Terminating Process: RUNDLL32.EXE
[07/04/2008, 22:18:29] - Disabling Automatic Shell Restart
[07/04/2008, 22:18:29] - Terminating Process: EXPLORER.EXE
[07/04/2008, 22:18:29] - Suspending the NT Session Manager System Service
[07/04/2008, 22:18:30] - Terminating Windows NT Logon/Logoff Manager
[07/04/2008, 22:18:30] - Re-enabling Automatic Shell Restart
[07/04/2008, 22:18:30] - File to disable: C:\WINDOWS\system32\jkkJbcCs.dll
[07/04/2008, 22:18:30] - Removing HKLM\...\Browser Helper Objects\{9C28EAFB-FF50-4F42-8D39-A006129CC907}
[07/04/2008, 22:18:30] - Removing HKCR\CLSID\{9C28EAFB-FF50-4F42-8D39-A006129CC907}
[07/04/2008, 22:18:30] - Adding Kill Bit for ActiveX for GUID: {9C28EAFB-FF50-4F42-8D39-A006129CC907}
[07/04/2008, 22:18:31] - Deleting ATLEvents/MSEvents Registry entries
[07/04/2008, 22:18:31] - Removing HKLM\...\Winlogon\Notify\jkkJbcCs
[07/04/2008, 22:18:31] - Searching for Browser Helper Objects:
[07/04/2008, 22:18:31] - BHO 1: {49F52407-CDCF-4C43-85BA-F1EBA31B961C} ()
[07/04/2008, 22:18:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:31] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/04/2008, 22:18:31] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/04/2008, 22:18:31] - BHO 2: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/04/2008, 22:18:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/04/2008, 22:18:31] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/04/2008, 22:18:31] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/04/2008, 22:18:31] - Finished Searching Browser Helper Objects
[07/04/2008, 22:18:31] - Finishing up...
[07/04/2008, 22:18:31] - A restart is needed.
[07/04/2008, 22:18:39] - Attempting to Restart via STOP error (Blue Screen!)
[07/05/2008, 2:39:11] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\3QVGV10S\VirtumundoBeGone[1].exe" )
[07/05/2008, 2:39:19] - Detected System Information:
[07/05/2008, 2:39:19] - Windows Version: 5.1.2600, Service Pack 2
[07/05/2008, 2:39:19] - Current Username: Compaq_Propriétaire (Admin)
[07/05/2008, 2:39:19] - Windows is in NORMAL mode.
[07/05/2008, 2:39:19] - Searching for Browser Helper Objects:
[07/05/2008, 2:39:19] - BHO 1: {A6006408-1AFC-4546-9343-CA1FB40B59A4} ()
[07/05/2008, 2:39:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 2:39:19] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/05/2008, 2:39:19] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/05/2008, 2:39:19] - BHO 2: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/05/2008, 2:39:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 2:39:19] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/05/2008, 2:39:19] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/05/2008, 2:39:19] - Finished Searching Browser Helper Objects
[07/05/2008, 2:39:19] - Finishing up...
[07/05/2008, 2:39:19] - Nothing found! Exiting...
[07/05/2008, 9:02:35] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\3QVGV10S\VirtumundoBeGone[1].exe" )
[07/05/2008, 9:02:41] - Detected System Information:
[07/05/2008, 9:02:41] - Windows Version: 5.1.2600, Service Pack 2
[07/05/2008, 9:02:41] - Current Username: Compaq_Propriétaire (Admin)
[07/05/2008, 9:02:41] - Windows is in NORMAL mode.
[07/05/2008, 9:02:41] - Searching for Browser Helper Objects:
[07/05/2008, 9:02:41] - BHO 1: {30D4FBF3-AAF4-422D-BCEE-B09DA9D6F787} ()
[07/05/2008, 9:02:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 9:02:41] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/05/2008, 9:02:41] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/05/2008, 9:02:41] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[07/05/2008, 9:02:41] - BHO 3: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/05/2008, 9:02:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/05/2008, 9:02:41] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/05/2008, 9:02:41] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/05/2008, 9:02:41] - Finished Searching Browser Helper Objects
[07/05/2008, 9:02:41] - Finishing up...
[07/05/2008, 9:02:41] - Nothing found! Exiting...
[07/06/2008, 9:20:26] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\MO911GGS\VirtumundoBeGone[1].exe" )
[07/06/2008, 9:20:31] - Detected System Information:
[07/06/2008, 9:20:31] - Windows Version: 5.1.2600, Service Pack 2
[07/06/2008, 9:20:31] - Current Username: Compaq_Propriétaire (Admin)
[07/06/2008, 9:20:31] - Windows is in NORMAL mode.
[07/06/2008, 9:20:31] - Searching for Browser Helper Objects:
[07/06/2008, 9:20:31] - BHO 1: {1B502BB3-F095-482C-B62F-72242A916C20} ()
[07/06/2008, 9:20:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/06/2008, 9:20:31] - Checking for HKLM\...\Winlogon\Notify\opnnlMCr
[07/06/2008, 9:20:31] - Key not found: HKLM\...\Winlogon\Notify\opnnlMCr, continuing.
[07/06/2008, 9:20:31] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[07/06/2008, 9:20:31] - BHO 3: {E6B91C03-9ACC-4052-9195-A7F4DE71C3E6} ()
[07/06/2008, 9:20:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/06/2008, 9:20:31] - Checking for HKLM\...\Winlogon\Notify\vtUolKEt
[07/06/2008, 9:20:31] - Key not found: HKLM\...\Winlogon\Notify\vtUolKEt, continuing.
[07/06/2008, 9:20:31] - Finished Searching Browser Helper Objects
[07/06/2008, 9:20:31] - Finishing up...
[07/06/2008, 9:20:31] - Nothing found! Exiting...
ensuite j'ai lancé symantec remove tool: rien trouvé
J'ai après désactivé la restauration du système et ai relancé les scans..même résultats.
QUant à Spybot, il a trouvé dans les 60 'problèmes' mais lorsque je clique sur le bouton 'resoudre les problèmes, tout se fige (sablier) et dans gestionnaire programme: programme ne repond pas.
Je voulais ensuite installer BHO Demon, mais ne l'ai pas trouvé disponible.
Entretemps j'ai désinstallé AntiVir, car les fenêtres qui s'ouvraient tous les deux secondes avec ce Bip nonstop, et ca pendant les 2 jours depuis que j'essaye de mon débarasser du/des virus - j'en pouvais plus...
Si quelqu'un pourrait m'aider? Je ne sais plus quoi faire du tout
MerciConfiguration: Windows XP
A voir également:
- J'ai tout tenté...please help!!!! vundo...
- Quelqu'un a tenté de se connecter à votre compte facebook - Guide
- Le pilote qui tente de démarrer n’est pas le même que le pilote de la carte vidéo en mode post. ✓ - Forum Pilotes (drivers)
- Le traitement de la stratégie de groupe a échoué. windows a tenté en vain de lire le fichier - Forum Windows serveur
- Problème d'accès aux GPO - Forum Windows
- Problème cartes graphiques.. Code 31 et code 43 - Forum Carte graphique
2 réponses
Télécharge Malwarebytes Anti-Malware
https://www.clubic.com/telecharger-fiche215092-malwarebytes-anti-malware.html
Avant tous çà desactive la Restauration du système après installe MBAM , Met le à jour , et lance un scan complet (tous les disques durs) , selectionne et supprime tous ce qu'il trouve et suit ce qu'il il te dit normalement après il doit te demander de redemarrer , et après tu relance un scan jusqu' à l' éradication complète de Vundo et quand il n'y aura plus rien tu peux réactiver la restauration du système
enjoy
https://www.clubic.com/telecharger-fiche215092-malwarebytes-anti-malware.html
Avant tous çà desactive la Restauration du système après installe MBAM , Met le à jour , et lance un scan complet (tous les disques durs) , selectionne et supprime tous ce qu'il trouve et suit ce qu'il il te dit normalement après il doit te demander de redemarrer , et après tu relance un scan jusqu' à l' éradication complète de Vundo et quand il n'y aura plus rien tu peux réactiver la restauration du système
enjoy
Pour Vundo --> un scan MBAM et Spybot
Mais pour ton problème de fond d'écran je ne sais pas car je n'est jamais vu ça j' aide pou Vundo car je l' ai déjà eu sinon j' appelle un expert sur les virus dans les fond d' écran
Mais pour ton problème de fond d'écran je ne sais pas car je n'est jamais vu ça j' aide pou Vundo car je l' ai déjà eu sinon j' appelle un expert sur les virus dans les fond d' écran
poste un rapport hijackthis
re salut
peut-etre un detournement de bureau
http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
mode d'emploi pour creer un rapport :
http://pageperso.aol.fr/balltrap34/demohijack.htm
Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.
ex:Renomme le fichier HijackThis.exe en Cçm.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste
Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."
y'aura toujour quelqun pour te l'analyser
re salut
peut-etre un detournement de bureau
http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
mode d'emploi pour creer un rapport :
http://pageperso.aol.fr/balltrap34/demohijack.htm
Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.
ex:Renomme le fichier HijackThis.exe en Cçm.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste
Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."
y'aura toujour quelqun pour te l'analyser
Merci pour ta reponse. j'ai fait ce que tu as dit et ai scanné et supprimé avec Malwarebytes. Voici le report:
Malwarebytes' Anti-Malware 1.19
Version de la base de données: 927
Windows 5.1.2600 Service Pack 2
12:27:26 06/07/2008
mbam-log-7-6-2008 (12-27-26).txt
Type de recherche: Examen complet (A:\|C:\|D:\|E:\|)
Eléments examinés: 115997
Temps écoulé: 42 minute(s), 47 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 12
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\opnnlMCr.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\tfwhftym.dll (Trojan.Vundo) -> Unloaded module successfully.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1b502bb3-f095-482c-b62f-72242a916c20} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{1b502bb3-f095-482c-b62f-72242a916c20} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\AntiSpywareMaster (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{02bfd7dc-ab51-4b70-bd6b-d803566f6c17} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec4a1cf6-ae63-45c3-b7c7-e427da6cbfd9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b117f787-30e1-47c9-a515-c3e6f1d21b76} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nqgpedlr.bvqs (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nqgpedlr.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\Source (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\186485f7 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ec4a1cf6-ae63-45c3-b7c7-e427da6cbfd9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnnlmcr -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnnlmcr -> Delete on reboot.
Dossier(s) infecté(s):
C:\Program Files\AntiSpywareMaster (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\netrax01 (Trojan.Agent) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\WINDOWS\system32\opnnlMCr.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\rCMlnnpo.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rCMlnnpo.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tfwhftym.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mytfhwft.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\epnv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\nqgpedlr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\mrvtdpqe.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\axrfgvek.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Le système m'a aussi dit que pas TOUT les fichiers pouvaient être detruits.
J'ai ensuite re-booté et SpyBot s'est mis en route au démarrage et a encore enlevé 50 fichiers à peu prés.
J'ai encore re-booté et cette fois ci Spy bot n'en a trouvé aucun.
Mais:
- comment etre sûr et certain que tout est nettoyé
- mon fond d'écran se met toujours en place bizarrement: d'abord fond d'écran que j'ai choisi sans icones, puis page bleu avec icones, puis page blanche avec icones, puis Mon fond d'écran avec icones, puis re-fond blanc avec icones. Il semble y avoir aussi un autre fond derrière mes icones (gestion des fichiers, autres emplacements, Details..)
- Quand je clique sur explorer, internet se connecte d'office sur goole, alors que j'avais toujours l'ouverture sur 'orange'
- le logo des pages internet (dans les onglets) est un espece de forme virale pas le 'e' classique d'explorer ou autre...
Merci
Ca m'inquiète si tu ne sais pas ....
Eteind, et redémarre ton pc et dis comment ça se passe....
ensuite, fais ce que dit Benurrr