Windows warning message

Re,

Je crains que XP Antivirus ne soit un rogue..

Salut,

Infecté Xp Antivirus.

Telecharges malwares bytes anti malwares :

Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

Fais un scan complet et postes le rapport.

Tu as un virus et tu dois le supprimer avec Antivirus XP

ok

voici le rapport de malawarebytes:

Malwarebytes' Anti-Malware 1.18
Version de la base de données: 871

18:57:04 18/08/2008
mbam-log-8-18-2008 (18-57-04).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 104225
Temps écoulé: 19 minute(s), 18 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\michel\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

Re,

Je crois que tu n'as pas mis a jour la base de donnees.

Moi j'ai la version 1062.

Fais une mise a jour a partir de malwarebytes.org par exemple.

voila le nouveau rapport:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1062
Windows 5.1.2600 Service Pack 2

20:21:39 18/08/2008
mbam-log-08-18-2008 (20-21-39).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 107445
Temps écoulé: 13 minute(s), 31 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
C:\WINDOWS\system32\lphcv1cj0er1q.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\blphcv1cj0er1q.scr (Trojan.FakeAlert) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcv1cj0er1q (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM313e2b3d.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM313e2b3d.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcv1cj0er1q.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphcv1cj0er1q.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\blphcv1cj0er1q.scr (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\michel\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\michel\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\michel\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

Je n'ai plus de message depuis que j'ai refait une analyse après mise à jour, ...

... Est-ce terminé ?

Non, certainement pas.

Tu vas faire ca :

Va ici :

https://www.bitdefender.com/toolbox/

Fais un scan complet.
Accepte l'activex, la licence etc..

Et postes le rapport.

(( C:\windows\bdoscan8\scanres.txt ))

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Tutorial : http://pageperso.aol.fr/loraline60/bitdefender_scan.htm

voici enfin le rapport de bitdefender :

[General]
App = "BitDefender Online Scanner v8"
Date = 19:08:2008
Time = 18:13:21
Scan Path = C:\;D:\;E:\;

[Engines Info]
Virus Definitions = 1569035
Engine build = "AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)"
Scan plugins = 16
Archive plugins = 43
Unpack plugins = 7
E-mail plugins = 6
System plugins = 5

[Scan Statistics]
Folders = 5289
Files = 294899
Archives = 6580
Packed files = 35043
Identified viruses = 6
Infected files = 19
Warnings = 0
Suspect files = 0
Disinfected files = 0
Deleted files = 19
Copied files = 0
Moved files = 0
Renamed files = 0
I/O Errors = 25

[Scan Settings]
SecondAction = Delete
FirstAction = Disinfect
Heuristics = 1
Enable Warnings = 1
Exclude Ext =
Extensions = *;
Scan Emails = 1
Scan Archives = 1
Scan Packed = 1
Scan Files = 1
Scan Boot = 1
Verify Memory = 0

[Scan Results]
Line00000051 = "C:\WINDOWS\system32\IEDFix.exe Infected with: IRC-Worm.Generic.3868"
Line00000050 = "C:\WINDOWS\system32\IEDFix.exe Deleted"
Line00000049 = "C:\WINDOWS\system32\afbbwkfr.dll Infected with: Trojan.Vundo.EUI"
Line00000048 = "C:\WINDOWS\system32\afbbwkfr.dll Disinfection failed"
Line00000047 = "C:\WINDOWS\system32\afbbwkfr.dll Deleted"
Line00000046 = "C:\WINDOWS\system32\hqhunceu.dll Infected with: Trojan.Vundo.EUI"
Line00000045 = "C:\WINDOWS\system32\hqhunceu.dll Disinfection failed"
Line00000044 = "C:\WINDOWS\system32\hqhunceu.dll Deleted"
Line00000043 = "C:\WINDOWS\system32\urighwjd.dll Infected with: Trojan.Vundo.EUI"
Line00000042 = "C:\WINDOWS\system32\urighwjd.dll Disinfection failed"
Line00000041 = "C:\WINDOWS\system32\urighwjd.dll Deleted"
Line00000040 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0000 Detected with: Adware.XpAntivirus.AJ"
Line00000039 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0000 Disinfection failed"
Line00000038 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0000 Deleted"
Line00000037 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o) Update failed"
Line00000036 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0014 Detected with: Adware.XpAntivirus.AJ"
Line00000035 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0014 Disinfection failed"
Line00000034 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0014 Deleted"
Line00000033 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o) Update failed"
Line00000032 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0019=>(NSIS g)=>lzma_solid_nsis0000 Detected with: Adware.XpAntivirus.AJ"
Line00000031 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0019=>(NSIS g)=>lzma_solid_nsis0000 Disinfection failed"
Line00000030 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0019=>(NSIS g)=>lzma_solid_nsis0000 Deleted"
Line00000029 = "C:\Documents and Settings\michel\Local Settings\Temp\.tt4A.tmp=>(NSIS o)=>lzma_solid_nsis0019=>(NSIS g) Update failed"
Line00000028 = "C:\Documents and Settings\michel\Menu Démarrer\Programmes\Démarrage\PowerReg Scheduler.exe Detected with: Application.Powerreg.Scheduler.C"
Line00000027 = "C:\Documents and Settings\michel\Menu Démarrer\Programmes\Démarrage\PowerReg Scheduler.exe Disinfection failed"
Line00000026 = "C:\Documents and Settings\michel\Menu Démarrer\Programmes\Démarrage\PowerReg Scheduler.exe Deleted"
Line00000025 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012886.scr Infected with: Trojan.FakeAlert.AAI"
Line00000024 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012886.scr Deleted"
Line00000023 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012901.scr Infected with: Trojan.FakeAlert.AAI"
Line00000022 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012901.scr Deleted"
Line00000021 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012916.scr Infected with: Trojan.FakeAlert.AAI"
Line00000020 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012916.scr Deleted"
Line00000019 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012930.scr Infected with: Trojan.FakeAlert.AAI"
Line00000018 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP108\A0012930.scr Deleted"
Line00000017 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0012958.exe Infected with: MemScan:Trojan.FakeAlert.AAH"
Line00000016 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0012958.exe Deleted"
Line00000015 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0012959.scr Infected with: Trojan.FakeAlert.AAI"
Line00000014 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0012959.scr Deleted"
Line00000013 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013003.exe Infected with: IRC-Worm.Generic.3868"
Line00000012 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013003.exe Deleted"
Line00000011 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013004.dll Infected with: Trojan.Vundo.EUI"
Line00000010 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013004.dll Disinfection failed"
Line00000009 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013004.dll Deleted"
Line00000008 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013005.dll Infected with: Trojan.Vundo.EUI"
Line00000007 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013005.dll Disinfection failed"
Line00000006 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013005.dll Deleted"
Line00000005 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013006.dll Infected with: Trojan.Vundo.EUI"
Line00000004 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013006.dll Disinfection failed"
Line00000003 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013006.dll Deleted"
Line00000002 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013007.exe Detected with: Application.Powerreg.Scheduler.C"
Line00000001 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013007.exe Disinfection failed"
Line00000000 = "C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013007.exe Deleted"

Re,

T'as du vundo et tu savais pas..

Clique sur ce lien
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
pour télécharger le fichier d'installation d'HijackThis.

Enregistre HJTInstall.exe sur ton bureau.

Double-clique sur HJTInstall.exe pour lancer le programme

Par défaut, il s'installera là :
C:\Program Files\Trend Micro\HijackThis

Avant toute installation, renommes le en lalala.exe.

Accepte la license en cliquant sur le bouton "I Accept"

Ensuite clique sur "do a system scan and save a logfile" et postes le rapport.

voila :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:52:54, on 19/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Arcade\PCMService.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\michel\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Tu n'as pas renommé HJT.

Va la :

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

Tu renommes HijackThis.exe en jj.exe, tu relances et tu postes le rapport.

Re !

Je ne viens pas critiquer, juste t'apporter quelques précisions !

Pas la peine de le renommer

Il faut le faire uniquement si tu ne vois pas de 02 et 020 sur le log !

Pour Vundo, MBAM l'a supprimé ( si l'ordi a été redémarré )

Il se trouve dans la restauration systeme ainsi que les autres trojans

C:\System Volume Information\_restore{54C92541-FB79-4F33-8CB2-B0F3D9C13594}\RP109\A0013006.dll Infected with: Trojan.Vundo.EUI"

Pour y remedier, il suffit de la désactiver, et la réactiver pour ainsi créer un poin de restauration propre !

Désactive ta "Restauration du système" puis réactive la.

(1) Désactivation
Clique droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > coche la case " Désactiver la Restauration du système sur tous les lecteurs"
Appliquer . patiente jusqu a que cela soit marqué "désactivée" puis Ok.

(2) Activation
Suivre le même chemin ; décoche la case "Désactiver la Restauration du système sur tous les lecteurs"
Appliquer. attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarre l'ordinateur !

@+

Line00000049 = "C:\WINDOWS\system32\afbbwkfr.dll Infected with: Trojan.Vundo.EUI"
Line00000048 = "C:\WINDOWS\system32\afbbwkfr.dll Disinfection failed"
Line00000047 = "C:\WINDOWS\system32\afbbwkfr.dll Deleted"
Line00000046 = "C:\WINDOWS\system32\hqhunceu.dll Infected with: Trojan.Vundo.EUI"
Line00000045 = "C:\WINDOWS\system32\hqhunceu.dll Disinfection failed"
Line00000044 = "C:\WINDOWS\system32\hqhunceu.dll Deleted"
Line00000043 = "C:\WINDOWS\system32\urighwjd.dll Infected with: Trojan.Vundo.EUI"
Line00000042 = "C:\WINDOWS\system32\urighwjd.dll Disinfection failed"
Line00000041 = "C:\WINDOWS\system32\urighwjd.dll Deleted"

ps) Deleted = effacé

de plus, aussi bien en 02 qu'en 04, on ne voit plus la présence de vundo .

Je pensais que tout n'a peut etre pas ete supprimé ..?

Histoire d'etre sur quoi, BitDefender ne connait peut etre pas tous les vundos........?

Bdefender non seulement les connais, mais en plus supprime ( contrairement a d'autres AV en ligne )

Et si on ne peux lui faire confiance, qu'est ce que ça và etre ?!! ;-)

résolu peut etre pas

A toi de finaliser maintenant ;-)

MàJ ( si besoin et une application en a besoin ), suppression des tools, etc...etc...

Ben je n'ai fait que MBAM et HJT.

Pour se debarrasser d'HJT :

Telecharges Tools Cleaner :

http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

Clique sur recherche.

Attends un peu.

Supprime ce qu'il trouve.

On pourrai alléger le démarrage du pc en arretant certaines applications inutiles non ?

Et la MàJ ?