Virtumonde/vundo

Bonjour,

j'ai ete recemment ete infecte par un virus/malware nomme vundo alias virtumonde,

depuis cette infection de nombreux problemes sont apparus sur mon pc.

apres moulte spybot, scan en ligne, scan en mode sans echec et tout le tralala je n'y suis toujours pas arriver a m'en

debarasser!

En esperant votre aide je vous poste ci dessous un rapport de Lop S&D

--------------------\\ Lop S&D 4.2.4-1 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Amaury ( Administrator )
BOOT : Normal boot
Antivirus : Trend Micro Internet Security 16.10.1182 (Activated)
Firewall : Trend Micro Personal Firewall 5.2 (Activated)

"C:\Lop SD" ( MAJ : 06-09-2008|22:02 )
Option : [1] ( 08/09/2008|18:19 )

--------------------\\ Listing des dossiers dans APPLIC~1

[16/05/2008|16:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{0E8E33D8-193A-414A-A909-0F101A142D26}
[01/07/2008|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[02/06/2008|20:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Age of Empires 3
[12/06/2006|22:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[17/05/2008|12:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
[18/10/2006|19:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
[27/09/2007|22:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[31/03/2008|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CCP
[10/05/2008|15:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Funcom
[17/02/2007|18:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[26/04/2008|12:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[04/08/2008|17:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Media Center Programs
[15/05/2008|00:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[18/03/2006|00:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[16/12/2005|15:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Network Associates
[27/06/2008|22:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[28/08/2008|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[25/08/2008|22:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[28/08/2008|20:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trend Micro
[26/04/2008|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
[31/12/2006|03:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[16/02/2008|13:11] C:\DOCUME~1\Amaury\APPLIC~1\Adobe
[01/07/2008|20:16] C:\DOCUME~1\Amaury\APPLIC~1\AdobeUM
[12/06/2006|22:06] C:\DOCUME~1\Amaury\APPLIC~1\Apple Computer
[16/12/2005|13:37] C:\DOCUME~1\Amaury\APPLIC~1\ATI
[18/10/2006|19:15] C:\DOCUME~1\Amaury\APPLIC~1\Autodesk
[05/09/2008|00:47] C:\DOCUME~1\Amaury\APPLIC~1\BitTorrent
[15/02/2007|20:48] C:\DOCUME~1\Amaury\APPLIC~1\DivX
[22/06/2008|23:24] C:\DOCUME~1\Amaury\APPLIC~1\DNA
[21/07/2008|16:10] C:\DOCUME~1\Amaury\APPLIC~1\dvdcss
[07/07/2008|17:39] C:\DOCUME~1\Amaury\APPLIC~1\EVEMon
[10/03/2008|19:32] C:\DOCUME~1\Amaury\APPLIC~1\FileZilla
[16/08/2007|14:36] C:\DOCUME~1\Amaury\APPLIC~1\GetRightToGo
[04/03/2007|02:23] C:\DOCUME~1\Amaury\APPLIC~1\Google
[08/08/2007|20:14] C:\DOCUME~1\Amaury\APPLIC~1\GrabIt
[28/08/2008|20:25] C:\DOCUME~1\Amaury\APPLIC~1\Hamachi
[09/04/2007|02:03] C:\DOCUME~1\Amaury\APPLIC~1\Help
[16/12/2005|13:07] C:\DOCUME~1\Amaury\APPLIC~1\Identities
[30/10/2007|19:01] C:\DOCUME~1\Amaury\APPLIC~1\InstallShield
[15/05/2008|00:16] C:\DOCUME~1\Amaury\APPLIC~1\Lavasoft
[17/12/2005|23:07] C:\DOCUME~1\Amaury\APPLIC~1\Macromedia
[22/05/2006|15:58] C:\DOCUME~1\Amaury\APPLIC~1\Media Player Classic
[23/08/2006|00:06] C:\DOCUME~1\Amaury\APPLIC~1\Microsoft
[29/08/2008|18:56] C:\DOCUME~1\Amaury\APPLIC~1\Mozilla
[18/03/2006|00:29] C:\DOCUME~1\Amaury\APPLIC~1\MSN6
[21/05/2006|23:59] C:\DOCUME~1\Amaury\APPLIC~1\Opera
[15/03/2008|22:06] C:\DOCUME~1\Amaury\APPLIC~1\PC Tools
[27/08/2008|17:22] C:\DOCUME~1\Amaury\APPLIC~1\rhcr0cj0en1l
[03/09/2007|21:44] C:\DOCUME~1\Amaury\APPLIC~1\ScummVM
[12/12/2006|22:18] C:\DOCUME~1\Amaury\APPLIC~1\SecuROM
[10/01/2008|21:50] C:\DOCUME~1\Amaury\APPLIC~1\Sierra Entertainment
[28/08/2008|22:43] C:\DOCUME~1\Amaury\APPLIC~1\Skype
[28/08/2008|18:18] C:\DOCUME~1\Amaury\APPLIC~1\skypePM
[04/09/2008|18:01] C:\DOCUME~1\Amaury\APPLIC~1\SPORE
[29/06/2008|18:20] C:\DOCUME~1\Amaury\APPLIC~1\SPORE Creature Creator
[27/08/2008|18:00] C:\DOCUME~1\Amaury\APPLIC~1\Sun
[22/12/2007|11:44] C:\DOCUME~1\Amaury\APPLIC~1\teamspeak2
[08/03/2008|13:57] C:\DOCUME~1\Amaury\APPLIC~1\Turbine
[27/12/2007|02:20] C:\DOCUME~1\Amaury\APPLIC~1\vlc

[02/12/2007|03:02] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[16/12/2005|12:56] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[16/12/2005|12:56] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[12/12/2006|20:48] C:\DOCUME~1\test\APPLIC~1\ATI
[12/12/2006|20:48] C:\DOCUME~1\test\APPLIC~1\Identities
[12/12/2006|20:49] C:\DOCUME~1\test\APPLIC~1\Microsoft

[12/12/2006|20:51] C:\DOCUME~1\TEST~1.AMA\APPLIC~1\ATI
[12/12/2006|20:51] C:\DOCUME~1\TEST~1.AMA\APPLIC~1\Identities
[12/12/2006|20:51] C:\DOCUME~1\TEST~1.AMA\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[08/09/2008 18:00][--ah-----] C:\WINDOWS\tasks\A686719D9065E629.job
[08/09/2008 17:58][--ah-----] C:\WINDOWS\tasks\SA.DAT
[28/08/2001 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( A686719D9065E629.job )=( c:\docume~1\amaury\applic~1\chinad~1\stupidgplidol.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[07/03/2008|23:34] C:\Program Files\7-Zip
[16/12/2005|15:31] C:\Program Files\Adobe
[11/05/2008|19:49] C:\Program Files\AGEIA Technologies
[18/10/2006|19:01] C:\Program Files\AnswerWorks 4.0
[17/05/2008|12:01] C:\Program Files\ATI Technologies
[18/10/2006|19:02] C:\Program Files\AutoCAD 2006
[18/10/2006|18:57] C:\Program Files\Autodesk
[16/12/2005|19:04] C:\Program Files\AvRack
[27/12/2007|02:25] C:\Program Files\AVSMedia
[09/05/2008|14:22] C:\Program Files\BitTorrent
[09/07/2008|19:51] C:\Program Files\BlackIsle
[20/07/2006|21:15] C:\Program Files\CachemanXP
[22/08/2008|23:20] C:\Program Files\CCleaner
[24/01/2007|20:06] C:\Program Files\Cheewoo
[16/12/2005|12:54] C:\Program Files\ComPlus Applications
[31/05/2008|01:58] C:\Program Files\DIFX
[25/08/2008|23:30] C:\Program Files\Digital Reality
[17/08/2008|13:49] C:\Program Files\DivX
[09/05/2008|14:22] C:\Program Files\DNA
[24/06/2008|18:31] C:\Program Files\Electronic Arts
[23/08/2006|16:51] C:\Program Files\EPSON
[09/04/2008|23:28] C:\Program Files\EVEMon
[27/08/2008|18:00] C:\Program Files\Fichiers communs
[06/12/2006|20:26] C:\Program Files\FlashGet
[24/08/2008|22:53] C:\Program Files\GameSpy Arcade
[02/09/2006|18:44] C:\Program Files\gmod9
[05/08/2007|12:27] C:\Program Files\Google
[23/08/2008|19:29] C:\Program Files\gPotato.eu
[05/09/2008|18:03] C:\Program Files\InstallShield Installation Information
[14/08/2008|00:37] C:\Program Files\Internet Explorer
[12/06/2006|22:05] C:\Program Files\iPod
[12/06/2006|22:05] C:\Program Files\iTunes
[27/08/2008|18:01] C:\Program Files\Java
[08/08/2008|02:36] C:\Program Files\Kalypso
[29/07/2007|22:41] C:\Program Files\LeechGet 2007
[01/07/2008|21:07] C:\Program Files\MegaDev
[14/08/2008|00:39] C:\Program Files\Messenger
[16/12/2005|12:57] C:\Program Files\microsoft frontpage
[28/08/2008|18:14] C:\Program Files\Microsoft Games
[18/10/2006|19:01] C:\Program Files\Microsoft Office
[22/05/2006|15:58] C:\Program Files\Mirage-Team Decoder Pack
[26/02/2008|20:48] C:\Program Files\mIRC
[16/12/2005|15:20] C:\Program Files\Movie Maker
[08/09/2008|18:15] C:\Program Files\Mozilla Firefox
[16/12/2005|12:54] C:\Program Files\MSN
[16/12/2005|12:54] C:\Program Files\MSN Gaming Zone
[17/11/2006|00:41] C:\Program Files\MSXML 4.0
[30/10/2007|19:01] C:\Program Files\NCSoft
[16/12/2005|15:19] C:\Program Files\NetMeeting
[16/12/2005|15:28] C:\Program Files\Network Associates
[10/05/2008|20:41] C:\Program Files\OO Software
[28/07/2008|08:51] C:\Program Files\OpenAL
[28/08/2008|23:26] C:\Program Files\Opera
[14/06/2007|00:35] C:\Program Files\Outlook Express
[21/01/2008|00:05] C:\Program Files\PGameScan
[09/04/2007|01:40] C:\Program Files\QuickSFV
[12/06/2006|22:06] C:\Program Files\QuickTime
[16/12/2005|19:04] C:\Program Files\Realtek Sound Manager
[17/03/2006|23:51] C:\Program Files\RegCleaner
[29/08/2008|17:56] C:\Program Files\ScummVM
[16/08/2008|18:01] C:\Program Files\SD EnterNET
[16/12/2005|12:54] C:\Program Files\Services en ligne
[27/06/2008|22:19] C:\Program Files\Skype
[24/08/2008|20:42] C:\Program Files\Sony
[28/08/2008|21:40] C:\Program Files\Spybot - Search & Destroy
[15/03/2008|22:36] C:\Program Files\Spyware Doctor
[22/08/2008|23:27] C:\Program Files\Steam
[26/04/2008|09:40] C:\Program Files\Tomato
[18/03/2006|00:34] C:\Program Files\ToniArts
[28/08/2008|20:40] C:\Program Files\Trend Micro
[16/12/2005|13:07] C:\Program Files\Uninstall Information
[19/04/2008|17:07] C:\Program Files\VDMSound
[16/03/2008|22:16] C:\Program Files\Veoh Networks
[06/04/2007|22:32] C:\Program Files\VideoLAN
[06/08/2008|00:57] C:\Program Files\WASTE
[29/12/2007|17:10] C:\Program Files\Windows Media Connect 2
[31/12/2006|03:54] C:\Program Files\Windows Media Player
[16/12/2005|15:19] C:\Program Files\Windows NT
[16/12/2005|12:54] C:\Program Files\WindowsUpdate
[09/04/2007|02:03] C:\Program Files\WinRAR
[03/08/2008|16:56] C:\Program Files\WowCartographe
[16/12/2005|12:57] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[01/07/2008|20:17] C:\Program Files\Fichiers communs\Adobe
[18/10/2006|19:02] C:\Program Files\Fichiers communs\Autodesk Shared
[27/12/2007|02:25] C:\Program Files\Fichiers communs\AVSMedia
[03/02/2007|17:02] C:\Program Files\Fichiers communs\Blizzard Entertainment
[24/01/2007|20:06] C:\Program Files\Fichiers communs\Cheewoo
[18/10/2006|19:01] C:\Program Files\Fichiers communs\Designer
[26/01/2008|19:55] C:\Program Files\Fichiers communs\DirectX
[26/04/2008|12:15] C:\Program Files\Fichiers communs\InstallShield
[27/08/2008|18:00] C:\Program Files\Fichiers communs\Java
[11/05/2008|18:54] C:\Program Files\Fichiers communs\Microsoft Shared
[16/12/2005|12:55] C:\Program Files\Fichiers communs\MSSoap
[16/12/2005|15:28] C:\Program Files\Fichiers communs\Network Associates
[16/12/2005|12:50] C:\Program Files\Fichiers communs\ODBC
[16/12/2005|12:55] C:\Program Files\Fichiers communs\Services
[27/06/2008|22:19] C:\Program Files\Fichiers communs\Skype
[16/12/2005|12:50] C:\Program Files\Fichiers communs\SpeechEngines
[14/06/2007|00:35] C:\Program Files\Fichiers communs\System
[10/06/2008|19:45] C:\Program Files\Fichiers communs\Wise Installation Wizard

--------------------\\ Process

( 44 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\Amaury\LOCALS~1\Temp\nse3.tmp
C:\DOCUME~1\Amaury\LOCALS~1\Temp\nsg4.tmp
C:\DOCUME~1\Amaury\LOCALS~1\Temp\nsj2D.tmp
C:\DOCUME~1\Amaury\LOCALS~1\Temp\nsk23.tmp
C:\WINDOWS\Tasks\A686719D9065E629.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\forkplusfrag]
"DisplayName"="CiD Help"
"UninstallString"="C:\\DOCUME~1\\Amaury\\APPLIC~1\\CHINAD~1\\dash remote.exe -uninstall"

--------------------\\ Verification du fichier Hosts

Fichier Hosts MODIFIE

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

-> 9187 [ 70 ## added by CiD ]

/!\ 2 Not 127.0.0.1 !!

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-08 18:26:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

C:\WINDOWS\system32\aadcKkkj.ini
C:\WINDOWS\system32\aadcKkkj.ini2
C:\WINDOWS\system32\GilRCJjl.ini
C:\WINDOWS\system32\GilRCJjl.ini2
C:\WINDOWS\system32\kidxonjr.ini
C:\WINDOWS\system32\kidxonjr.ini2
C:\WINDOWS\system32\kidxonjr.tmp
C:\WINDOWS\system32\xluhwiva.ini
C:\WINDOWS\system32\xluhwiva.ini2
C:\WINDOWS\system32\xluhwiva.tmp
C:\WINDOWS\system32\ycbJknnn.ini
C:\WINDOWS\system32\ycbJknnn.ini2
[b]==> VUNDO <==/b

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Amaury\Bureau\Crack
C:\DOCUME~1\Amaury\Bureau\Hgm109nocdCrack-WLV
C:\DOCUME~1\Amaury\Bureau\Crack\CLauncher.exe
C:\DOCUME~1\Amaury\Bureau\Hgm109nocdCrack-WLV\!CrackNoCD.nfo
C:\DOCUME~1\Amaury\Bureau\Hgm109nocdCrack-WLV\File_id.diz
C:\DOCUME~1\Amaury\Bureau\Hgm109nocdCrack-WLV\Hgm109nocd.exe

[F:35][D:38]-> C:\DOCUME~1\Amaury\LOCALS~1\Temp
[F:12][D:0]-> C:\DOCUME~1\Amaury\Cookies
[F:1333][D:4]-> C:\DOCUME~1\Amaury\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 08/09/2008|18:38 - Option : [1]

--------------------\\ Fin du rapport a 18:38:41

Cordialement konoro