probleme avec virtumondeFermé

Question

Bonjour,
j'ai téléchargé hijackthis et voici le rapport produit
pouvez-vous m'aider svp ???

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:46: VIRUS ALERT!, on 2008-08-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\utilisateur\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: rtsplgob - {4DE15B3F-84EE-4F6F-BA12-B0AB8229C2F1} - C:\WINDOWStsplgob.dll (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [80b5e410] rundll32.exe "C:\WINDOWS\system32\pctutkkt.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LimeWire Acceleration Patch] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\LimeWire Acceleration Patch\LimeWire Acceleration Patch.lnk
O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide 2007\ic2007pp.dll
O20 - AppInit_DLLs: xatuyq.dll ewpjqk.dll
O21 - SSODL: rnopbfgt - {0D03F32C-2091-47F6-9D55-2C742CD12215} - C:\WINDOWSnopbfgt.dll (file missing)
O21 - SSODL: xkefqtgs - {8B5AC242-F8AE-4182-B5BA-87EA4801DCEF} - C:\WINDOWS\xkefqtgs.dll (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

plm69 · Answer

Bonsoir,

Télécharge VundoFix ...
http://www.atribune.org/ccount/click.php?id=4 ... sur ton Bureau.

* Double-clique sur VundoFix.exe afin de le lancer.
* Clique sur le bouton Scan for Vundo.
* Lorsque le scan est complété, clique sur le bouton Remove Vundo.
* Une invite te demandera si tu veux supprimer les fichiers, clique "YES".
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique "OK".
* Redémarre ton PC.
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt

Note : il est possible que VundoFix soit confronté à un fichier qu'il ne
peut supprimer.
Si tel est le cas, l'outil se lancera au prochain redémarrage ; il faut
simplement suivre les instructions ci-haut, à partir de "clique sur le
bouton Scan for Vundo".

-------
Télécharge VirtumondeBegone ...
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

* Lance VirtumondeBegone.exe puis, suis les instructions.
* Une fois son travail terminé, redémarre puis, poste le rapport.

------
Fais un scan avec Malwarebytes Anti-Malware
http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam
... et poste le rapport.

PS : pour supprimer les infections, choisis l'option Supprimer la sélection
ou clique sur le bouton "Remove Selected" (version anglaise) en bas à gauche.

cocoduc · Answer

voici le rapport de vundofix, je l'ai fait plusieurs fois depuis ce matin mais un fichier demeure toujours la

VundoFix V7.0.6

Scan started at 10:08:18 2008-08-16

Listing files found while scanning....

C:\Windows\system32\opnmKcBs.dll
C:\Windows\system32\sBcKmnpo.ini
C:\Windows\system32\sBcKmnpo.ini2
C:\Windows\system32\xxyxxYPf.dll

VundoFix V7.0.6

Scan started at 10:15:20 2008-08-16

Listing files found while scanning....

C:\Windows\system32\opnmKcBs.dll
C:\Windows\system32\sBcKmnpo.ini
C:\Windows\system32\sBcKmnpo.ini2
C:\Windows\system32\xxyxxYPf.dll

Beginning removal...

 Attempting to delete C:\Windows\system32\opnmKcBs.dll
C:\Windows\system32\opnmKcBs.dll Has been deleted!

 Attempting to delete C:\Windows\system32\sBcKmnpo.ini
C:\Windows\system32\sBcKmnpo.ini Has been deleted!

 Attempting to delete C:\Windows\system32\sBcKmnpo.ini2
C:\Windows\system32\sBcKmnpo.ini2 Has been deleted!

 Attempting to delete C:\Windows\system32\xxyxxYPf.dll
C:\Windows\system32\xxyxxYPf.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\Windows\system32\xxyxxYPf.dll
C:\Windows\system32\xxyxxYPf.dll Could not be deleted.

 Attempting to delete C:\Windows\system32\xxyxxYPf.dll
C:\Windows\system32\xxyxxYPf.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V7.0.6

Scan started at 10:26:00 2008-08-16

Listing files found while scanning....

C:\Windows\system32\cBSlKcax.dll
C:\Windows\system32\xacKlSBc.ini
C:\Windows\system32\xacKlSBc.ini2
C:\Windows\system32\xxyxxYPf.dll

Beginning removal...

 Attempting to delete C:\Windows\system32\cBSlKcax.dll
C:\Windows\system32\cBSlKcax.dll Has been deleted!

 Attempting to delete C:\Windows\system32\xacKlSBc.ini
C:\Windows\system32\xacKlSBc.ini Has been deleted!

 Attempting to delete C:\Windows\system32\xacKlSBc.ini2
C:\Windows\system32\xacKlSBc.ini2 Has been deleted!

 Attempting to delete C:\Windows\system32\xxyxxYPf.dll
C:\Windows\system32\xxyxxYPf.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\Windows\system32\xxyxxYPf.dll
C:\Windows\system32\xxyxxYPf.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\Windows\system32\xxyxxYPf.dll
C:\Windows\system32\xxyxxYPf.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Performing Repairs to the registry.
Done!

VundoFix V7.0.6

Scan started at 10:58:26 2008-08-16

Listing files found while scanning....

C:\Windows\system32\xxyxxYPf.dll

Beginning removal...

 Attempting to delete C:\Windows\system32\xxyxxYPf.dll
C:\Windows\system32\xxyxxYPf.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V7.0.6

Scan started at 13:52:32 2008-08-16

Listing files found while scanning....

No infected files were found.

plm69 · Answer

fais le scan de begone et mbam

cocoduc · Answer

voici le rapport de begone
mbam est en cours. rapport sous peu

merci

[08/16/2008, 14:19:15] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\utilisateur\Local Settings\Temporary Internet Files\Content.IE5\93FJ0W0S\VirtumundoBeGone[1].exe" )
[08/16/2008, 14:19:19] - Detected System Information:
[08/16/2008, 14:19:19] -  Windows Version: 5.1.2600, Service Pack 2
[08/16/2008, 14:19:19] -  Current Username: utilisateur (Admin)
[08/16/2008, 14:19:19] -  Windows is in NORMAL mode.
[08/16/2008, 14:19:19] - Searching for Browser Helper Objects:
[08/16/2008, 14:19:19] -  BHO 1: {44b51ba5-0525-4475-a0a0-aea49d7085b9} ()
[08/16/2008, 14:19:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/16/2008, 14:19:19] -  Checking for HKLM\...\Winlogon\Notify\ewpjqk
[08/16/2008, 14:19:19] -  Key not found: HKLM\...\Winlogon\Notify\ewpjqk, continuing.
[08/16/2008, 14:19:19] -  BHO 2: {4BDFB2E2-0192-4070-B6EA-A5CF918128F1} ()
[08/16/2008, 14:19:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/16/2008, 14:19:19] -  Checking for HKLM\...\Winlogon\Notify\opnmKcBs
[08/16/2008, 14:19:19] -  Key not found: HKLM\...\Winlogon\Notify\opnmKcBs, continuing.
[08/16/2008, 14:19:19] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[08/16/2008, 14:19:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/16/2008, 14:19:19] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[08/16/2008, 14:19:19] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[08/16/2008, 14:19:19] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/16/2008, 14:19:19] -  BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/16/2008, 14:19:19] -  BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/16/2008, 14:19:19] -  BHO 7: {BA44CBC8-E16A-4F36-B066-4D75699E171D} ()
[08/16/2008, 14:19:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/16/2008, 14:19:19] -  Checking for HKLM\...\Winlogon\Notify\xxyxxYPf
[08/16/2008, 14:19:19] -  Key not found: HKLM\...\Winlogon\Notify\xxyxxYPf, continuing.
[08/16/2008, 14:19:19] -  BHO 8: {CA529788-B836-4DE2-B6D3-DC125A6DE32B} ()
[08/16/2008, 14:19:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/16/2008, 14:19:19] -  Checking for HKLM\...\Winlogon\Notify\hgGaxuRJ
[08/16/2008, 14:19:19] -  Key not found: HKLM\...\Winlogon\Notify\hgGaxuRJ, continuing.
[08/16/2008, 14:19:19] -  BHO 9: {FCFA648E-6BE0-412B-83B0-EB9A36CA06C7} ()
[08/16/2008, 14:19:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/16/2008, 14:19:19] -  Checking for HKLM\...\Winlogon\Notify\cBSlKcax
[08/16/2008, 14:19:19] -  Key not found: HKLM\...\Winlogon\Notify\cBSlKcax, continuing.
[08/16/2008, 14:19:19] - Finished Searching Browser Helper Objects
[08/16/2008, 14:19:19] - Finishing up...
[08/16/2008, 14:19:19] - Nothing found! Exiting...

cocoduc · Answer

voici le rapport mbam

j'attends de vos nouvelles

merci

Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1058
Windows 5.1.2600 Service Pack 2

15:04:43 2008-08-16
mbam-log-8-16-2008 (15-04-37).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 121713
Temps écoulé: 50 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 12
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 64

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\hgGaxuRJ.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\pctutkkt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ewpjqk.dll (Trojan.Vundo) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44b51ba5-0525-4475-a0a0-aea49d7085b9} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{44b51ba5-0525-4475-a0a0-aea49d7085b9} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca529788-b836-4de2-b6d3-dc125a6de32b} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ca529788-b836-4de2-b6d3-dc125a6de32b} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOTtsplgob.bsmk (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOTtsplgob.toolbar.1 (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\80b5e410 (Trojan.Vundo) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\hggaxurj -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\hggaxurj  -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55711-640-2060571-23684) -> No action taken.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\ewpjqk.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\hgGaxuRJ.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\JRuxaGgh.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\JRuxaGgh.ini2 (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\pctutkkt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32	kktutcp.ini (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\utilisateur\Local Settings\Temporary Internet Files\Content.IE5\8VP70QT1\kb456456[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\utilisateur\Local Settings\Temporary Internet Files\Content.IE5\EKO5KIIN\kb767887[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\utilisateur\Local Settings\Temporary Internet Files\Content.IE5\MCS4YWG5\cntr[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\utilisateur\Local Settings\Temporary Internet Files\Content.IE5\O78LKIGQ\cntr[1] (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP224\A0011698.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP224\A0012698.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP219\A0011573.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP229\A0013789.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP229\A0013790.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP229\A0013791.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP229\A0013792.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014789.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014790.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014791.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014792.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014793.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014794.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014795.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP235\A0014796.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP237\A0016810.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP241\A0016867.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP241\A0016868.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP250\A0017041.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0017118.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0017156.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0017158.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0018169.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0018170.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0018174.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0018175.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0018178.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{24B563B7-76F5-432A-B111-77BC8CC32FB6}\RP252\A0018179.dll (Trojan.Vundo) -> No action taken.
C:\VundoFix Backups\cBSlKcax.dll.bad (Trojan.Vundo) -> No action taken.
C:\WINDOWS\ertf.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\ddoube.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\expralgq.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32
ktgbm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\plsavt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\puawgqeg.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\gmrume.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\goccrgbn.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\avxlnsiy.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\sibmhdmt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\knclsgat.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\aamvsbhd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\mbwhdm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ztycwi.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\hrcchl.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\hyfhgfpa.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\hytfxaeh.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ijwebj.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\pebgkxwq.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\utilisateur\Application Data\TmpRecentIcons\antivirus-2008pro.lnk (Rogue.Link) -> No action taken.
C:\Documents and Settings\utilisateur\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk (Rogue.Antivirus2008) -> No action taken.
C:\Documents and Settings\utilisateur\Local Settings\Temp\bindserv.exe (Trojan.FakeAlert) -> No action taken.

plm69 · Answer

Tu as fais le scan en mode sans echec ???? car il n'a rien supprimer. si tu as bien fait en mode sans echec fais en mode normal 80taine de virus

cocoduc · Answer

j'ai fait le scan en mode normal ... ? faudrait-il que je le fasse également en mode sans échec ?

cocoduc · Answer

de plus, j'ai supprimé la majorité des fichiers, il m'a d'ailleurs mentionné qu'il y avait certains fichiers qu'il ne pouvait pas supprimer ... je ne comprends pas pourquoi ca n'apparait pas dans le rapport

plm69 · Answer

alors fais en mode sans echec stp

cocoduc · Answer

Voici le rapport du 2e scan, tout semble okay donc il a vraiment supprimé les fichiers infectés la 1ère fois
j'attends de tes nouvelles mais depuis le redémarrage, tout va beaucoup mieux

Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1058
Windows 5.1.2600 Service Pack 2

16:04:23 2008-08-16
mbam-log-8-16-2008 (16-04-23).txt

Type de recherche: Examen rapide
Eléments examinés: 53498
Temps écoulé: 7 minute(s), 8 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Probleme avec virtumonde

10 réponses

Discussions similaires

Newsletters