Virus vundo

Question

Bonjour,

Voilà mon antivirus ma détecté plusieurs virus sous le nom de vundo, mais il n'arrive pas à s'en débarrasser.
je sais que c'est un sujet qui revient souvent mes j'ai jamais vu la même solutions. J'en ai essayer plusieurs, mais il est toujours là, et j'y comprends rien
J'ai vu que certain personne demander le scan de HijackThis pour pouvoir aider, alors voici le miens


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:49:07, on 13/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\TuneUpDefragService.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\winsys2.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [54536409] rundll32.exe "C:\WINDOWS\system32\gbehsjqu.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1757981266-1979792683-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'Default user')
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Destrio5 · Answer

Salut,

Tu n'as pas que du Vundo.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

yobou · Answer

Merci pour votre aide. J'ai fais tout ce que vous m'avez dit. Il y a eu une erreur au redemarage, apparemment il manque un fichier dll, mais ensuite combofix a pu finir et voici le log : ComboFix 08-09-12.03 - UU 2008-09-13 2:37:45.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1471 [GMT 2:00] Lancé depuis: E:\Julien\ComboFix.exe * Un nouveau point de restauration a été créé [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C: est.txt C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\bbwypddw.ini C:\WINDOWS\system32\efcYOHya.dll C:\WINDOWS\system32\eOqAHkkj.ini C:\WINDOWS\system32\eOqAHkkj.ini2 C:\WINDOWS\system32\gbehsjqu.dll C:\WINDOWS\system32\khfFYQGX.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32 mp73.tmp C:\WINDOWS\system32 mp74.tmp C:\WINDOWS\system32\uqjshebg.ini C:\WINDOWS\system32\wddpywbb.dll C:\WINDOWS\system32\yqhvgyhw.ini . ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 )))))))))))))))))))))))))))))))))))) . 2008-09-13 02:38 . 2008-09-13 02:38 1,085,440 --a------ C:\WINDOWS\system32\bbwypddw.tmp 2008-09-13 02:38 . 2008-09-13 02:38 0 --a------ C:\WINDOWS\system32\uqjshebg.tmp 2008-09-13 01:48 . 2008-09-13 01:48 d-------- C:\Program Files\Trend Micro 2008-09-13 01:25 . 2008-09-13 01:25 d-------- C:\VundoFix Backups 2008-09-10 12:27 . 2008-09-10 12:27 d-------- C:\Documents and Settings\UU\Application Data\Grisoft 2008-09-10 12:22 . 2008-09-10 12:22 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-09-10 12:22 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-09-09 22:39 . 2008-09-10 20:28 4,331 ---hs---- C:\WINDOWS\system32\jmwoicim.ini 2008-09-09 11:03 . 2008-09-09 11:03 d-------- C:\Program Files\Electronic Arts 2008-09-09 11:02 . 2008-09-09 11:12 d-------- C:\Documents and Settings\UU\Application Data\Spore 2008-09-08 19:26 . 2008-09-08 19:26 d-------- C:\Program Files\Paradox Interactive 2008-09-08 19:24 . 2008-09-09 22:39 3,971 ---hs---- C:\WINDOWS\system32\ciwiwmeg.ini 2008-09-08 19:23 . 2008-09-08 19:23 311,296 --a------ C:\WINDOWS\system32\jkkHAqOe.dll 2008-09-05 22:23 . 2008-09-05 22:23 d-------- C:\Documents and Settings\UU\Application Data\vlc 2008-09-05 21:08 . 2008-09-05 21:08 d-------- C:\Program Files\VideoLAN 2008-09-04 18:20 . 2008-09-04 18:20 d-------- C:\Documents and Settings\UU\Application Data\KC Softwares 2008-09-04 18:17 . 2008-09-10 13:51 d-------- C:\Program Files\RelevantKnowledge 2008-09-04 18:17 . 2008-09-04 18:17 d-------- C:\Program Files\KC Softwares 2008-08-28 12:24 . 2008-08-28 12:24 d--h----- C:\WINDOWS\PIF 2008-08-15 18:39 . 2008-08-15 18:39 d-------- C:\Program Files\Fichiers communs\DirectX 2008-08-15 09:47 . 2008-08-15 09:47 268 --ah----- C:\sqmdata13.sqm 2008-08-15 09:47 . 2008-08-15 09:47 244 --ah----- C:\sqmnoopt13.sqm 2008-08-13 16:26 . 2008-08-13 16:26 304,528 --a------ C:\WINDOWS\system32\appdrvrem01.exe 2008-08-13 14:16 . 2008-08-13 14:16 d-------- C:\Program Files\Cyanide . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-13 00:45 9,308,192 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-13 00:41 114,260 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-12 21:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-12 21:25 --------- d-----w C:\Program Files\Sega 2008-09-12 15:26 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-12 09:49 --------- d-----w C:\Program Files\EA SPORTS 2008-09-12 09:11 2,800,128 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp 2008-09-10 12:53 --------- d-----w C:\Program Files\LimeWire 2008-09-08 17:21 --------- d-----w C:\Program Files\eMule 2008-09-05 09:18 --------- d-----w C:\Program Files\BitComet 2008-08-15 16:37 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-15 14:52 --------- d-----w C:\Documents and Settings\UU\Application Data\Pro Cycling Manager 2008 2008-08-13 08:09 --------- d-----w C:\Documents and Settings\UU\Application Data\OpenOffice.org2 2008-08-11 20:34 --------- d-----w C:\Documents and Settings\UU\Application Data\Pro Cycling Manager 2008 - Demo 2008-07-31 15:19 614,912 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp 2008-07-31 15:19 2,653,696 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp 2008-07-30 12:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Codemasters 2008-07-28 08:46 --------- d-----w C:\Program Files\SpywareBlaster 2008-07-28 08:36 --------- d-----w C:\Program Files\Lavasoft 2008-07-20 18:53 --------- d-----w C:\Documents and Settings\UU\Application Data\Nero 2008-07-20 18:44 --------- d-----w C:\Program Files\Nero 2008-07-20 18:44 --------- d-----w C:\Program Files\Fichiers communs\Nero 2008-07-20 18:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2008-07-20 14:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-07-20 14:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-07-20 14:01 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-07-20 14:00 --------- d-----w C:\Program Files\Windows Live 2008-07-20 14:00 --------- d-----w C:\Program Files\MSN Messenger 2008-07-20 13:58 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-07-20 13:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-07-20 13:47 --------- d-----w C:\Program Files\Foxit Software 2008-07-20 13:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2008-07-20 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-20 13:30 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-07-20 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-20 13:09 355,584 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe 2008-07-20 13:09 --------- d-----w C:\Program Files\TuneUp Utilities 2008 2008-07-20 13:08 --------- d-----w C:\Documents and Settings\UU\Application Data\TuneUp Software 2008-07-20 13:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-07-09 07:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe 2008-07-09 07:05 54,672 ----a-w C:\WINDOWS\system32\vsutil_loc040c.dll 2008-07-09 07:05 42,384 ----a-w C:\WINDOWS\zllsputility_loc040c.dll 2008-07-09 07:05 21,904 ----a-w C:\WINDOWS\system32\imsinstall_loc040c.dll 2008-07-09 07:05 17,808 ----a-w C:\WINDOWS\system32\imslsp_install_loc040c.dll 2008-07-09 07:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-21 16:29 2,992,128 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp 2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-18 20:12 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-06-18 20:12 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89263A6F-0443-4FE1-902D-5FAC4C6B0285}] 2008-09-08 19:23 311296 --a------ C:\WINDOWS\system32\jkkHAqOe.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15360] "ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-06-25 1209584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-07-20 847872] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-17 8478720] "SW20"="C:\WINDOWS\system32\sw20.exe" [2006-12-15 208896] "WinSys2"="C:\WINDOWS\system32\winsys2.exe" [2006-12-15 217088] "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" [2006-12-19 136768] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-02-25 221184] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-08-17 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-02-03 430080] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.enc"= ITIG726.acm "VIDC.YV12"= yv12vfw.dll "msacm.divxa32"= divxa32.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\LimeWire\LimeWire.exe"= "C:\Program Files\Network Associates\Common Framework\FrameworkService.exe"= "C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe"= "C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"= "C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"= "C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\PCM.exe"= "C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe"= "C:\Program Files\Sega\Beijing 2008\Beijing.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19857:TCP"= 19857:TCP:BitComet 19857 TCP "19857:UDP"= 19857:UDP:BitComet 19857 UDP "14407:TCP"= 14407:TCP:BitComet 14407 TCP "14407:UDP"= 14407:UDP:BitComet 14407 UDP R2 pgsql-8.2;PostgreSQL Database Server 8.2;C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe runservice -N pgsql-8.2 -D C:\Program Files\PostgreSQL\8.2\data\ [ ] R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2006-03-02 14336] R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2004-11-22 208851] R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2004-11-22 10324] R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2004-11-22 34789] S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-01-24 13352] S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys [ ] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-20 355584] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11772b26-2a19-11dc-96d8-806d6172696f}] \Shell\AutoRun\command - F:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bac97a67-e9b0-11db-ae28-000ea6f7d555}] \Shell\AutoRun\command - G:\setupSNK.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DDDFC9C8-A0F8-E0CF-AF00-F0F423E36752}] C:\WINDOWS\system32\svchast.exe . Contenu du dossier 'Tƒches planifi‚es' . - - - - ORPHELINS SUPPRIMES - - - - BHO-{1FB5C8F6-82F0-49CE-BCD9-9C80DDA48E26} - C:\WINDOWS\system32\khfFYQGX.dll BHO-{7D78F107-E029-41D2-AE01-1317F0388D4A} - (no file) HKLM-Run-54536409 - C:\WINDOWS\system32\wddpywbb.dll ShellExecuteHooks-{1FB5C8F6-82F0-49CE-BCD9-9C80DDA48E26} - C:\WINDOWS\system32\khfFYQGX.dll Notify-khfFYQGX - khfFYQGX.dll . ------- Examen suppl‚mentaire ------- . FireFox -: Profile - C:\Documents and Settings\UU\Application Data\Mozilla\Firefox\Profiles\kfd3gpkg.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-13 02:44:20 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cach‚s ... Recherche d'‚l‚ments en d‚marrage automatique cach‚s ... Recherche de fichiers cach‚s ... Scan termin‚ avec succŠs Fichiers cach‚s: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Network Associates\Common Framework aPrdMgr.exe C:\WINDOWS\system32 vsvc32.exe C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\WINDOWS\system32 undll32.exe C:\Program Files\Network Associates\Common Framework\Mctray.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe . ************************************************************************** . Heure de fin: 2008-09-13 2:50:00 - La machine a red‚marr‚ ComboFix-quarantined-files.txt 2008-09-13 00:49:56 Avant-CF: 11,395,547,136 octets libres Après-CF: 11,282,980,864 octets libres 226 --- E O F --- 2008-08-16 00:49:16 apparemment c'est déjà mieux car mon antivirus ne trouve plus vundo mais apres je sais pas ....

Destrio5 · Answer

/!\ Seul yobou peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :





KillAll::

File::
C:\WINDOWS\system32\bbwypddw.tmp
C:\WINDOWS\system32\uqjshebg.tmp 
C:\WINDOWS\system32\jmwoicim.ini 
C:\WINDOWS\system32\ciwiwmeg.ini 
C:\WINDOWS\system32\jkkHAqOe.dll 
C:\WINDOWS\system32\winsys2.exe
C:\WINDOWS\system32\svchast.exe 
F:\autorun.exe 
G:\setupSNK.exe 

Rootkit::
C:\sqmdata16.sqm 
C:\sqmnoopt16.sqm 
C:\sqmnoopt15.sqm 
C:\sqmdata15.sqm 
C:\sqmnoopt14.sqm 
C:\sqmdata14.sqm 
C:\sqmnoopt13.sqm 
C:\sqmdata13.sqm 
C:\sqmdata12.sqm 
C:\sqmdata11.sqm 
C:\sqmnoopt12.sqm 
C:\sqmnoopt11.sqm 
C:\sqmdata10.sqm 
C:\sqmnoopt10.sqm 
C:\sqmnoopt09.sqm 
C:\sqmnoopt08.sqm 
C:\sqmdata09.sqm 
C:\sqmdata08.sqm 
C:\sqmnoopt07.sqm 
C:\sqmdata07.sqm 
C:\sqmnoopt06.sqm 
C:\sqmdata06.sqm 
C:\sqmnoopt05.sqm 
C:\sqmdata05.sqm 
C:\sqmdata04.sqm
C:\sqmdata03.sqm
C:\sqmdata02.sqm
C:\sqmdata01.sqm
C:\sqmdata00.sqm
C:\sqmnoopt04.sqm 
C:\sqmnoopt03.sqm 
C:\sqmnoopt02.sqm 
C:\sqmnoopt01.sqm 
C:\sqmnoopt00.sqm 

Folder:: 
C:\VundoFix Backups 

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89263A6F-0443-4FE1-902D-5FAC4C6B0285}]  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"WinSys2"=-
"LVCOMSX"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11772b26-2a19-11dc-96d8-806d6172696f}] 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bac97a67-e9b0-11db-ae28-000ea6f7d555}] 
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DDDFC9C8-A0F8-E0CF-AF00-F0F423E36752}] 





---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

yobou · Answer

il faut que je fasse ça toujours en désactivant antivirus et antispyware et aussi couper internet ???

Destrio5 · Answer

Oui, c'est mieux.

De toute façon, tous les programmes vont se fermer.

yobou · Answer

alors voici la suite... ComboFix 08-09-12.03 - UU 2008-09-13 3:36:27.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1565 [GMT 2:00] Lancé depuis: C:\Documents and Settings\UU\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\UU\Bureau\CFScript.txt * Un nouveau point de restauration a été créé [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\eOqAHkkj.ini C:\WINDOWS\system32\eOqAHkkj.ini2 C:\WINDOWS\system32\kgfbgtos.ini C:\WINDOWS\system32\sotgbfgk.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 )))))))))))))))))))))))))))))))))))) . 2008-09-13 02:38 . 2008-09-13 02:38 1,085,440 --a------ C:\WINDOWS\system32\bbwypddw.tmp 2008-09-13 02:38 . 2008-09-13 02:38 0 --a------ C:\WINDOWS\system32\uqjshebg.tmp 2008-09-13 01:48 . 2008-09-13 01:48 d-------- C:\Program Files\Trend Micro 2008-09-13 01:25 . 2008-09-13 01:25 d-------- C:\VundoFix Backups 2008-09-10 12:27 . 2008-09-10 12:27 d-------- C:\Documents and Settings\UU\Application Data\Grisoft 2008-09-10 12:22 . 2008-09-10 12:22 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-09-10 12:22 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-09-09 22:39 . 2008-09-10 20:28 4,331 ---hs---- C:\WINDOWS\system32\jmwoicim.ini 2008-09-09 11:03 . 2008-09-09 11:03 d-------- C:\Program Files\Electronic Arts 2008-09-09 11:02 . 2008-09-09 11:12 d-------- C:\Documents and Settings\UU\Application Data\Spore 2008-09-08 19:26 . 2008-09-08 19:26 d-------- C:\Program Files\Paradox Interactive 2008-09-08 19:24 . 2008-09-09 22:39 3,971 ---hs---- C:\WINDOWS\system32\ciwiwmeg.ini 2008-09-08 19:23 . 2008-09-08 19:23 311,296 --a------ C:\WINDOWS\system32\jkkHAqOe.dll 2008-09-05 22:23 . 2008-09-05 22:23 d-------- C:\Documents and Settings\UU\Application Data\vlc 2008-09-05 21:08 . 2008-09-05 21:08 d-------- C:\Program Files\VideoLAN 2008-09-04 18:20 . 2008-09-04 18:20 d-------- C:\Documents and Settings\UU\Application Data\KC Softwares 2008-09-04 18:17 . 2008-09-10 13:51 d-------- C:\Program Files\RelevantKnowledge 2008-09-04 18:17 . 2008-09-04 18:17 d-------- C:\Program Files\KC Softwares 2008-08-28 12:24 . 2008-08-28 12:24 d--h----- C:\WINDOWS\PIF 2008-08-15 18:39 . 2008-08-15 18:39 d-------- C:\Program Files\Fichiers communs\DirectX 2008-08-15 09:47 . 2008-08-15 09:47 268 --ah----- C:\sqmdata13.sqm 2008-08-15 09:47 . 2008-08-15 09:47 244 --ah----- C:\sqmnoopt13.sqm 2008-08-13 16:26 . 2008-08-13 16:26 304,528 --a------ C:\WINDOWS\system32\appdrvrem01.exe 2008-08-13 14:16 . 2008-08-13 14:16 d-------- C:\Program Files\Cyanide . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-13 01:43 9,357,344 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-13 01:41 13,213,703 ----a-w C:\WINDOWS\Internet Logs vDebug.zip 2008-09-13 01:39 114,836 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-12 21:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-12 21:25 --------- d-----w C:\Program Files\Sega 2008-09-12 15:26 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-12 09:49 --------- d-----w C:\Program Files\EA SPORTS 2008-09-12 09:11 2,800,128 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp 2008-09-10 12:53 --------- d-----w C:\Program Files\LimeWire 2008-09-08 17:21 --------- d-----w C:\Program Files\eMule 2008-09-05 09:18 --------- d-----w C:\Program Files\BitComet 2008-08-15 16:37 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-15 14:52 --------- d-----w C:\Documents and Settings\UU\Application Data\Pro Cycling Manager 2008 2008-08-13 08:09 --------- d-----w C:\Documents and Settings\UU\Application Data\OpenOffice.org2 2008-08-11 20:34 --------- d-----w C:\Documents and Settings\UU\Application Data\Pro Cycling Manager 2008 - Demo 2008-07-31 15:19 614,912 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp 2008-07-31 15:19 2,653,696 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp 2008-07-30 12:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Codemasters 2008-07-28 08:46 --------- d-----w C:\Program Files\SpywareBlaster 2008-07-28 08:36 --------- d-----w C:\Program Files\Lavasoft 2008-07-20 18:53 --------- d-----w C:\Documents and Settings\UU\Application Data\Nero 2008-07-20 18:44 --------- d-----w C:\Program Files\Nero 2008-07-20 18:44 --------- d-----w C:\Program Files\Fichiers communs\Nero 2008-07-20 18:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2008-07-20 14:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-07-20 14:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-07-20 14:01 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-07-20 14:00 --------- d-----w C:\Program Files\Windows Live 2008-07-20 14:00 --------- d-----w C:\Program Files\MSN Messenger 2008-07-20 13:58 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-07-20 13:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-07-20 13:47 --------- d-----w C:\Program Files\Foxit Software 2008-07-20 13:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2008-07-20 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-20 13:30 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-07-20 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-20 13:09 355,584 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe 2008-07-20 13:09 --------- d-----w C:\Program Files\TuneUp Utilities 2008 2008-07-20 13:08 --------- d-----w C:\Documents and Settings\UU\Application Data\TuneUp Software 2008-07-20 13:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-07-09 07:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe 2008-07-09 07:05 54,672 ----a-w C:\WINDOWS\system32\vsutil_loc040c.dll 2008-07-09 07:05 42,384 ----a-w C:\WINDOWS\zllsputility_loc040c.dll 2008-07-09 07:05 21,904 ----a-w C:\WINDOWS\system32\imsinstall_loc040c.dll 2008-07-09 07:05 17,808 ----a-w C:\WINDOWS\system32\imslsp_install_loc040c.dll 2008-07-09 07:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-21 16:29 2,992,128 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp 2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-18 20:12 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-06-18 20:12 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B859A-6D32-411A-8EC7-B7965FFDE924}] 2008-09-08 19:23 311296 --a------ C:\WINDOWS\system32\jkkHAqOe.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15360] "ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-06-25 1209584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-07-20 847872] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-17 8478720] "SW20"="C:\WINDOWS\system32\sw20.exe" [2006-12-15 208896] "WinSys2"="C:\WINDOWS\system32\winsys2.exe" [2006-12-15 217088] "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" [2006-12-19 136768] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-02-25 221184] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-08-17 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "54536409"="C:\WINDOWS\system32\sotgbfgk.dll" [BU] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-02-03 430080] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\khfFYQGX] khfFYQGX.dll [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.enc"= ITIG726.acm "VIDC.YV12"= yv12vfw.dll "msacm.divxa32"= divxa32.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\LimeWire\LimeWire.exe"= "C:\Program Files\Network Associates\Common Framework\FrameworkService.exe"= "C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe"= "C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"= "C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"= "C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\PCM.exe"= "C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe"= "C:\Program Files\Sega\Beijing 2008\Beijing.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19857:TCP"= 19857:TCP:BitComet 19857 TCP "19857:UDP"= 19857:UDP:BitComet 19857 UDP "14407:TCP"= 14407:TCP:BitComet 14407 TCP "14407:UDP"= 14407:UDP:BitComet 14407 UDP R2 pgsql-8.2;PostgreSQL Database Server 8.2;C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe runservice -N pgsql-8.2 -D C:\Program Files\PostgreSQL\8.2\data\ [ ] R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2006-03-02 14336] R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2004-11-22 208851] R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2004-11-22 10324] R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2004-11-22 34789] S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-01-24 13352] S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys [ ] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-20 355584] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11772b26-2a19-11dc-96d8-806d6172696f}] \Shell\AutoRun\command - F:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bac97a67-e9b0-11db-ae28-000ea6f7d555}] \Shell\AutoRun\command - G:\setupSNK.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DDDFC9C8-A0F8-E0CF-AF00-F0F423E36752}] C:\WINDOWS\system32\svchast.exe . Contenu du dossier 'Tƒches planifi‚es' . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-13 03:41:28 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cach‚s ... Recherche d'‚l‚ments en d‚marrage automatique cach‚s ... Recherche de fichiers cach‚s ... Scan termin‚ avec succŠs Fichiers cach‚s: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Network Associates\Common Framework aPrdMgr.exe C:\WINDOWS\system32 vsvc32.exe C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe C:\WINDOWS\system32 undll32.exe C:\Program Files\Network Associates\Common Framework\Mctray.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\Program Files\PostgreSQL\8.2\bin\postgres.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe . ************************************************************************** . Heure de fin: 2008-09-13 3:47:34 - La machine a red‚marr‚ ComboFix-quarantined-files.txt 2008-09-13 01:47:30 ComboFix2.txt 2008-09-13 00:50:02 Avant-CF: 11,489,566,720 octets libres Après-CF: 11,459,813,376 octets libres 210 --- E O F --- 2008-08-16 00:49:16

yobou · Answer

Destrio5 n'est plus là ?

Destrio5 · Answer

---> Télécharge OTMoveIt2 à partir du lien ci-dessous : 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe 

---> Enregistre le fichier sur le Bureau.

---> Double-clique sur le fichier OTMoveIt2.exe pour lancer l'outil.
Assure-toi que la case Unregister Dll's and Ocx's soit bien cochée.

---> Copie l'intégralité du texte ci-dessous et colle-le dans la fenêtre intitulée Paste List Of Files/Folders to Move.




C:\WINDOWS\system32\bbwypddw.tmp
C:\WINDOWS\system32\uqjshebg.tmp
C:\WINDOWS\system32\jmwoicim.ini
C:\WINDOWS\system32\ciwiwmeg.ini
C:\WINDOWS\system32\jkkHAqOe.dll
C:\WINDOWS\system32\winsys2.exe
C:\WINDOWS\system32\svchast.exe
F:\autorun.exe
G:\setupSNK.exe
C:\sqmdata16.sqm
C:\sqmnoopt16.sqm
C:\sqmnoopt15.sqm
C:\sqmdata15.sqm
C:\sqmnoopt14.sqm
C:\sqmdata14.sqm
C:\sqmnoopt13.sqm
C:\sqmdata13.sqm
C:\sqmdata12.sqm
C:\sqmdata11.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt11.sqm
C:\sqmdata10.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt08.sqm
C:\sqmdata09.sqm
C:\sqmdata08.sqm
C:\sqmnoopt07.sqm
C:\sqmdata07.sqm
C:\sqmnoopt06.sqm
C:\sqmdata06.sqm
C:\sqmnoopt05.sqm
C:\sqmdata05.sqm
C:\sqmdata04.sqm
C:\sqmdata03.sqm
C:\sqmdata02.sqm
C:\sqmdata01.sqm
C:\sqmdata00.sqm
C:\sqmnoopt04.sqm
C:\sqmnoopt03.sqm
C:\sqmnoopt02.sqm
C:\sqmnoopt01.sqm
C:\sqmnoopt00.sqm
C:\VundoFix Backups\




---> Clique sur MoveIt! pour lancer la suppression.
Lorsqu'un résultat apparaît dans le cadre Results, clique sur Exit.

Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES. 

---> Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles.

yobou · Answer

je sais pas si quelqu'un est de nouveau la pour m'aider avec mon petit vundo car apparemment je l'ai toujours.

Destrio5 · Answer

Fais la manip' de mon précédent message.

yobou · Answer

voila le rapport encore merci de ton aide

C:\WINDOWS\system32\bbwypddw.tmp moved successfully.
C:\WINDOWS\system32\uqjshebg.tmp moved successfully.
C:\WINDOWS\system32\jmwoicim.ini moved successfully.
C:\WINDOWS\system32\ciwiwmeg.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jkkHAqOe.dll
C:\WINDOWS\system32\jkkHAqOe.dll NOT unregistered.
C:\WINDOWS\system32\jkkHAqOe.dll moved successfully.
C:\WINDOWS\system32\winsys2.exe moved successfully.
C:\WINDOWS\system32\svchast.exe moved successfully.
File/Folder F:\autorun.exe not found.
File/Folder G:\setupSNK.exe not found.
File/Folder C:\sqmdata16.sqm not found.
File/Folder C:\sqmnoopt16.sqm not found.
File/Folder C:\sqmnoopt15.sqm not found.
File/Folder C:\sqmdata15.sqm not found.
File/Folder C:\sqmnoopt14.sqm not found.
File/Folder C:\sqmdata14.sqm not found.
C:\sqmnoopt13.sqm moved successfully.
C:\sqmdata13.sqm moved successfully.
C:\sqmdata12.sqm moved successfully.
C:\sqmdata11.sqm moved successfully.
C:\sqmnoopt12.sqm moved successfully.
C:\sqmnoopt11.sqm moved successfully.
C:\sqmdata10.sqm moved successfully.
C:\sqmnoopt10.sqm moved successfully.
C:\sqmnoopt09.sqm moved successfully.
C:\sqmnoopt08.sqm moved successfully.
C:\sqmdata09.sqm moved successfully.
C:\sqmdata08.sqm moved successfully.
C:\sqmnoopt07.sqm moved successfully.
C:\sqmdata07.sqm moved successfully.
C:\sqmnoopt06.sqm moved successfully.
C:\sqmdata06.sqm moved successfully.
C:\sqmnoopt05.sqm moved successfully.
C:\sqmdata05.sqm moved successfully.
C:\sqmdata04.sqm moved successfully.
C:\sqmdata03.sqm moved successfully.
C:\sqmdata02.sqm moved successfully.
C:\sqmdata01.sqm moved successfully.
C:\sqmdata00.sqm moved successfully.
C:\sqmnoopt04.sqm moved successfully.
C:\sqmnoopt03.sqm moved successfully.
C:\sqmnoopt02.sqm moved successfully.
C:\sqmnoopt01.sqm moved successfully.
C:\sqmnoopt00.sqm moved successfully.
C:\VundoFix Backups moved successfully.
File/Folder  not found.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09142008_002232

Destrio5 · Answer

- Crée un fichier Bloc-notes avec le texte qui se trouve dans l'encadré ci-dessous (copie/colle): 



REGEDIT4

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89263A6F-0443-4FE1-902D-5FAC4C6B0285}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinSys2"=-
"LVCOMSX"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11772b26-2a19-11dc-96d8-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bac97a67-e9b0-11db-ae28-000ea6f7d555}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DDDFC9C8-A0F8-E0CF-AF00-F0F423E36752}]



- Enregistre ce fichier dans : Bureau
- Nom du fichier : fix.reg
- Type : tous les fichiers !!
- Clique sur Enregistrer
- Quitte le Bloc-notes

Utilisation du fichier : fix.reg :
Double-clique sur le fichier (Bureau) / Accepte l'avertissement concernant la fusion / ne pas s'étonner de ne rien voir / valide le message disant que la fusion est terminée.

yobou · Answer

C'est bon j'ai fait tout ça.....?

Destrio5 · Answer

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

yobou · Answer

le voila, j'ai été obliger de redemarrer pour qu'il finish la suppression....

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1147
Windows 5.1.2600 Service Pack 2

14/09/2008 01:27:28
mbam-log-2008-09-14 (01-27-28).txt

Type de recherche: Examen rapide
Eléments examinés: 44254
Temps écoulé: 1 minute(s), 36 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32	leedifn.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\54536409 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sw20 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsys2 (Spyware.OnlineGames) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32	leedifn.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32
fideelt.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sw20.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sw24.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Destrio5 · Answer

Poste un nouveau rapport HijackThis.

yobou · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:46:24, on 14/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.3.28.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {94C1C7F4-87F1-4895-B83C-CC89D6FBC26F} - C:\WINDOWS\system32\jkkHAqOe.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1757981266-1979792683-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'Default user')
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: khfFYQGX - khfFYQGX.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Destrio5 · Answer

Tu tiens vraiment à McAfee ?

yobou · Answer

plutôt pourquoi. C'est pas mon ordi donc j'y tient mais pourquoi c'est lui qui pose probleme.

Destrio5 · Answer

Garde-le alors.

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Mets à jour Java :
https://www.java.com/fr/download/manual.jsp

---> Poste un nouveau rapport HijackThis

yobou · Answer

Selon cet antivirus n'est pas genial ? si oui tu conseille quoi ?

Sinon voilà le rapport


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:06:32, on 14/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.3.28.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {94C1C7F4-87F1-4895-B83C-CC89D6FBC26F} - C:\WINDOWS\system32\jkkHAqOe.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1757981266-1979792683-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'Default user')
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: khfFYQGX - khfFYQGX.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

yobou · Answer

t'es parti detrio

Destrio5 · Answer

Personnellement, je ne le trouve pas génial. Il est lent à intégrer les nouvelles infections.

yobou · Answer

et tu me conseille lequel alors et sinon pour mes conneries ca ressemble a quoi....?

Destrio5 · Answer

Je te conseille Antivir :
http://dlce.antivir.com/preversion_fr/preversion_fr_exe.html

yobou · Answer

Et sinon pour mes virus c'est bon ou j'en suis encore loin????

Destrio5 · Answer

On a fait le plus gros, fais un scan complet avec Antivir.

Virus vundo - Page 2

Discussions similaires

Newsletters