Virus Résolu

Question

Bonjour,

J'ai depusi quelques jours, un problème. Je pense avoir un virus, qui ouvre des pages internet explorer de publicité alors que je n'utilise pas IE, il y a un tres grand nombre de fichiers .tmp dans mes documents et dans mon disque dur principal. Dans mon poste de travail, mon DD interne C: à l'image d'une croix rouge.
Ajoutter à ca que ce virus à l'air de télécharger de nombreux troyens et/ou vers (je sais pas trop).
De nombreux messages d'erreurs apparraissent notament sur des problème de mémoires qui pourraient rendre instavle mon système

Je possède Avast et Ad-Aware, que j'ai fait tourner et qui bien qu'ayant résolu une partie des problèmes, ils reviennent.

Je ne sais plus trop quoi faire, merci d'avance de m'aider et de me donner la marche a suivre.

nardino · Answer

Bonsoir.
Procédure de prénettoyage du pc.
1°- Télécharger, au besoin, les logiciels suivants

-CCleaner : https://www.ccleaner.com/

Clique sur Download CCleaner now...
Installe-le.
Un excellent tutoriel de Jesses pour le paramétrer : http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm
Attention: Décoche l'installation de la Yahoo Toolbar pendant l'installation.

Il va nettoyer les fichiers temporaires.

-AVG-AntiSpyware 7.5 : https://www.avg.com/en-ww/free-antivirus-download

Tu télécharges et installes AVG AntiSpyware en cliquant sur Downlaod now (bouton orange en bas de page).

Celui-ci installé, tu ouvres AVG AntiSpyware et sur la page d'accueil tu peux modifier l'état de :

Bouclier résident 
Mise à jour automatique 

Ces deux services ne seront actifs que 30 jours mais le programme restera valable pour les analyses et le nettoyage par la suite.
Il suffira toujours de prendre la précaution de le mettre à jour avant usage.

Tu cliques sur "Mise à jour" et "Commencer la mise à jour" dans la fenêtre suivante.

Puis dans l'onglet "Paramètres"
Sous la question "Comment réagir ?", clique gauche sur "Actions recommandées" et choisis "Quarantaine".
Coche "Générer un rapport après chaque analyse"
Tu refermes pour le moment.

-Hijackthis 2.0.2 de Trend Micro : http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php?page=download

Il sera installé par défaut dans C:\Program Files\TrendMicro\HijackThis2.0.2\HijackThis.exe

-Antivir de Avira : https://www.avira.com/

Clique sur "download here" en bas de la colonne Classic et dans la fenêtre suivante clique sur la version de ton système. 
(Attention pas disponible pour Vista 64 bits.)

Enregistre le fichier (16.4 Mo) et installe le programme.
Voici un tutoriel pour ce faire et bien paramétrer le programme.

http://speedweb1.free.fr/frames2.php?page=tuto5
Merci à Tesgaz.

2°-  Démarrage en mode sans échec et nettoyage des fichiers. 

Important de faire la procédure sous ce mode.
Il faut choisir la même session que celle qui est infectée et non pas la session "Administrateur" qui n'apparaît que sous ce mode.

Après la fermeture de la première fenêtre, au tout début de la phase de démarrage du PC (boot), appuie sur F8.
Une fenêtre de type DOS s'ouvre, sélectionne "Mode sans échec" à l'aide des flèches du clavier et clique sur Entrée (Enter).
Ne t'inquiète pas de l'aspect, Windows démarre avec le minimum nécessaire et peut prendre quelque minutes pour démarrer.

-C-Cleaner

Ouvre CCleaner et clique sur Analyse, puis quand elle est terminée, clique sur Lancer le nettoyage.

Il sera effectué même si tu vois encore l'affichage dans le cadre principal. 

3°- Lancement des scans antispywares et antivirus

-AVG

Tu ouvres AVG antiSpyware.
Sur la page d'accueil, tu choisis "Analyser maintenant".
Puis "Analyse complète du système" dans la nouvelle fenêtre.
Puis quand le scan est terminé, tu choisis "Appliquer les actions", bouton en bas à gauche.
Tu sauves le rapport en cliquant sur "Enregistrer le rapport d'analyse", puis dans la fenêtre suivante "Enregistrer le rapport sous",tu obtiens un fichier: 
Report-Scan-2007****-******.txt 
Tu choisis le bureau et tu posteras ce dernier par copier-coller pra la suite.

-ANTIVIR

Tu désactives ton antivirus habituel.
Tu cliques sur l'icône du bureau pour lancer Antivir.
Dans l'onglet Scanner,; tu cliques sur la croix devant Manual Selection et tu coches Poste de travail.
Tu laisses tout coché pour la première analyse.
Tu cliques sur l'icône en forme de loupe en-dessous de Status pour lancer l'analyse qui peut durer une heure.
Il est préférable de ne pas s'éloigner pour répondre aux messages en cas d'alerte.
Tu choisis Moved to quarantine pour tout ce qu'il trouve.
Quand le scan est terminé, tu clique sur End.

4°- Redémarrage en mode normal.

-Scan Hijackthis:
Lance-le par "Do a system scan and save a logfile".
Et tu le refermes pour le moment.
"Tu attends les résultats de l'analyse."

Tu postes les trois rapports suivants par copier-coller dans ta réponse :

- Hijackthis = situé ici :C:\Program Files\ Trend Micro\ Hijackthis\[b]hijackthis.log[/b], tu l'ouvres.
- AVGAS = Report-Scan-2007****-******.txt établi par AVG et enregistré sur le bureau ou bien, si tu as raté une étape tu ouvres AVGAS et dans Rapport, 
tu sélectionnes celui qui correspond à la date et enregistrer sous et tu le fais sur le bureau.
- Antivir = Tu ouvres le programme et dans l'onglet Reports, choisi Scan avec la date correspondante, double-clique dessus et ensuite sur Report file et 
fais un copier-coller de la totalité.

job · Answer

Bonjour,

Tout d'abord merci à toi de m'aider, j'ai eu quelques problèmes, j'ai pas réussi à enregistrer le rapport de AVG (la case enregistrer le rapport était grisé..).

Sinon lorsque j'ai "l'antivir guard" d'activé j'ai des messages d'erreurs à répétition
"C:\WINDOWS\system32\geeda.dll
Is the Troyan horse TR/Vundo.Gen"

Quoi que je fasse il revient toujours, du coup j'ai désactivé antivir.
J'ai aussi ces messages d'erreurs à l'ouverture de windows:

[URL=https://imageshack.com/][IMG]http://img147.imageshack.us/img147/2546/erreurrrrrrscf4.th.jpg[/IMG][/URL]

Bon sinon voilà les autres rapports demandés:

AntiVir PersonalEdition Classic
Report file date: dimanche 23 décembre 2007 22:36

Scanning for 988313 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Jean Baptiste
Computer name: KAMOULOX

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 19:00:57
ANTIVIR2.VDF : 7.0.1.96 2048 Bytes 14/12/2007 19:00:57
ANTIVIR3.VDF : 7.0.1.144 227328 Bytes 23/12/2007 19:00:57
AVEWIN32.DLL : 7.6.0.46 3084800 Bytes 23/12/2007 19:00:58
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.2 360488 Bytes 23/12/2007 19:00:59
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: J:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: dimanche 23 décembre 2007 22:36

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
14 processes with 14 modules were scanned

Start scanning boot sectors:
Boot sector 'A:\'
[NOTE] In the drive 'A:\' no data medium is inserted!
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Boot sector 'E:\'
[NOTE] No virus was found!

Starting to scan the registry.
C:\WINDOWS\system32\hbkxmhin.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[INFO] The file was moved to '47d9d557.qua'!
C:\WINDOWS\system32\hbkxmhin.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
C:\WINDOWS\system32\ihssxlvl.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\system32\ihssxlvl.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
C:\WINDOWS\system32\jkkkljk.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\system32\jkkkljk.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
C:\Program Files\Router\Router.exe
[DETECTION] Is the Trojan horse TR/Dldr.Textrec
[INFO] The file was moved to '47e3d586.qua'!
C:\Program Files\Router\Router.exe
[DETECTION] Is the Trojan horse TR/Dldr.Textrec

The registry was scanned ( '39' files ).

Starting the file scan:

Begin scan in 'A:\'
Search path A:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Fred\Local Settings\Temporary Internet Files\Content.IE5\SDMN8XER\popup[1].htm
[DETECTION] Contains detection pattern of the exploits EXP/Agent.B
[INFO] The file was moved to '47ded6ab.qua'!
C:\Documents and Settings\Fred\Local Settings\Temporary Internet Files\Content.IE5\SDMN8XER\popup[1].php
[0] Archive type: GZ
--> popup[1]
[DETECTION] Contains detection pattern of the exploits EXP/Agent.B
[INFO] The file was moved to '47ded6ac.qua'!
C:\Program Files\Fichiers communs\Yazzle1281OinAdmin.exe
[DETECTION] Is the Trojan horse TR/Dldr.Purity.BV.7
[INFO] The file was moved to '47e8e5b1.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP523\A0072789.exe
[DETECTION] Is the Trojan horse TR/Dldr.AW.awm
[INFO] The file was moved to '479ee940.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP523\A0072792.exe
[DETECTION] Is the Trojan horse TR/Dldr.Agent.ezc
[INFO] The file was moved to '461e3d41.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP523\A0072794.dll
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '479ee941.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-10.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e95a.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-11.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230d3.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-13.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e95c.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-14.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e95b.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-15.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230d4.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-16.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e95d.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-17.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230d5.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-2.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e95e.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-25.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230d7.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-3.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e950.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-4.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230d6.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-5.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e95f.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-6.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230e8.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-7.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230d9.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-8.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e952.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP524\snapshot\MFEX-9.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230db.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\A0072829.dll
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '479ee94b.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-10.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e962.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-11.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230eb.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-13.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e963.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-14.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230ec.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-15.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e965.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-16.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e964.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-17.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230ed.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-2.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e966.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-25.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230ee.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-3.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e967.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-4.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230e0.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-5.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e969.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-6.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230ef.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-7.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '47b3e978.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-8.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230f1.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP525\snapshot\MFEX-9.DAT
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '463230e2.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP527\A0072958.dll
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '479ee958.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073027.dll
[DETECTION] Is the Trojan horse TR/Vundo.DRT
[INFO] The file was moved to '479ee95c.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073653.vbs
[DETECTION] Is the Trojan horse TR/Small.WY
[INFO] The file was moved to '479ee9b0.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073654.exe
[DETECTION] Is the Trojan horse TR/Dldr.Agent.fjn.1
[INFO] The file was moved to '461e3db1.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073655.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[INFO] The file was moved to '479ee9b1.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073656.exe
[DETECTION] Is the Trojan horse TR/Dldr.Textrec
[INFO] The file was moved to '461e3db2.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073657.exe
[DETECTION] Is the Trojan horse TR/Dldr.Purity.BV.7
[INFO] The file was moved to '479ee9b3.qua'!
C:\WINDOWS\b111.exe
[DETECTION] Is the Trojan horse TR/Dldr.Agent.fjv
[INFO] The file was moved to '479fe9b5.qua'!
C:\WINDOWS\b149.exe
[DETECTION] Is the Trojan horse TR/Drop.Agent.ctu
[INFO] The file was moved to '47a2e9b5.qua'!
C:\WINDOWS\system32\cdoupdji.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47dded56.qua'!
C:\WINDOWS\system32\geeda.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\system32\hggghih.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47d5ed73.qua'!
C:\WINDOWS\system32\idfksnyd.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47d4ed72.qua'!
C:\WINDOWS\system32\ihssxlvl.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\system32\jkkkljk.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\system32\drivers\dtscsi.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd9965.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <Jeux>
Begin scan in 'E:\' <Vidéo>
E:\jay-ieg\Données Perso\Cours 2ème année\neruda solar\SphinxME\Fichiers\MacrosLexica.dot
[DETECTION] Contains suspicious code HEUR/Macro.Word95
[INFO] The file was moved to '47d1fbb1.qua'!
Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'G:\'
Search path G:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'I:\'
Search path I:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'J:\'
Search path J:\ could not be opened!
Le périphérique n'est pas prêt.

End of the scan: lundi 24 décembre 2007 01:25
Used time: 2:48:44 min

The scan has been done completely.

14343 Scanning directories
449823 Files were scanned
58 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
0 files were deleted
0 files were repaired
54 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
449765 Files not concerned
2538 Archives were scanned
9 Warnings
1 Notes

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:24, on 24/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\pqtvngnu.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Nettoyage\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Nettoyage\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [Gjsjaln] C:\WINDOWS\?ymbols\w?crtupd.exe
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Jean Baptiste\Application Data\WinTouch\WinTouch.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NETGEAR WG311v2 Smart Configuration.lnk = C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\pqtvngnu.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\prohdy.html

nardino · Answer

Bonjour.
Télécharge VundoFix de Atribune : 
http://www.atribune.org/ccount/click.php?id=4

	[*]Double clic sur Vundofix.exe.
	[*]Coche la case Run VundoFix as a task
	[*]Répond OK au popup qui s'ouvre.
Il va se refermer et réouvrir au bout d'une minute environ.
	[*]Quand il est rouvert, clique sur Scan for Vundo
	[*]Quand le scan est terminé, clique sur Remove Vundo
	[*]Réponds Yes à la demande de suppression des fichiers.
	[*]Il te sera demandé de redémarrer ton ordinateur, accepte bien sûr.
	[*]Copie/colle le rapport (c:\vundofix.txt) dans ta réponse avec un nouveau rapport Hijackthis.

job · Answer

Salut,

Voilà c'est fait:


VundoFix V6.7.7

Checking Java version...

Scan started at 11:48:48 24/12/2007

Listing files found while scanning....

C:\WINDOWS\system32\adeeg.bak1
C:\WINDOWS\system32\adeeg.bak2
C:\WINDOWS\system32\adeeg.ini
C:\WINDOWS\system32\bmjmuova.dll
C:\WINDOWS\system32\dgilfxpr.dll
C:\WINDOWS\system32\geeda.dll
C:\WINDOWS\system32\ihssxlvl.dll
C:\windows\system32\ihssxlvl.dllbox
C:\WINDOWS\system32\jkkkljk.dll
C:\WINDOWS\system32\jpgxqkgo.dll
C:\WINDOWS\system32\pqtvngnu.exe
C:\WINDOWS\system32\pyftyvyj.dll
C:\WINDOWS\system32\vfqaufgn.exe
C:\WINDOWS\system32\wavvjugh.dll
C:\WINDOWS\system32\wxlgckqc.exe

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\adeeg.bak1
C:\WINDOWS\system32\adeeg.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\adeeg.bak2
C:\WINDOWS\system32\adeeg.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\adeeg.ini
C:\WINDOWS\system32\adeeg.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\bmjmuova.dll
C:\WINDOWS\system32\bmjmuova.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\dgilfxpr.dll
C:\WINDOWS\system32\dgilfxpr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\geeda.dll
C:\WINDOWS\system32\geeda.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ihssxlvl.dll
C:\WINDOWS\system32\ihssxlvl.dll Could not be deleted.

 Attempting to delete C:\windows\system32\ihssxlvl.dllbox
C:\windows\system32\ihssxlvl.dllbox Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkkkljk.dll
C:\WINDOWS\system32\jkkkljk.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\jpgxqkgo.dll
C:\WINDOWS\system32\jpgxqkgo.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pqtvngnu.exe
C:\WINDOWS\system32\pqtvngnu.exe Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\pyftyvyj.dll
C:\WINDOWS\system32\pyftyvyj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vfqaufgn.exe
C:\WINDOWS\system32\vfqaufgn.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wavvjugh.dll
C:\WINDOWS\system32\wavvjugh.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wxlgckqc.exe
C:\WINDOWS\system32\wxlgckqc.exe Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\ihssxlvl.dll
C:\WINDOWS\system32\ihssxlvl.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pqtvngnu.exe
C:\WINDOWS\system32\pqtvngnu.exe Could not be deleted.

Performing Repairs to the registry.
Done!





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:54:25, on 24/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\WINDOWS\?ymbols\w?crtupd.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Nettoyage\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {02A3EED1-7311-4B18-A515-CD125BF443D5} - C:\WINDOWS\system32\geeda.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {0ac69a99-10f2-1c0b-9514-b93d20bb53ce} - {ec35bb02-d39b-4159-b0c1-2f0199a96ca0} - C:\WINDOWS\system32\idfksnyd.dll (file missing)
O2 - BHO: (no name) - {FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856} - C:\WINDOWS\system32\jkkkljk.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [Gjsjaln] C:\WINDOWS\?ymbols\w?crtupd.exe
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Jean Baptiste\Application Data\WinTouch\WinTouch.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NETGEAR WG311v2 Smart Configuration.lnk = C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\pqtvngnu.exe (file missing)
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\prohdy.html

nardino · Answer

Bonsoir,

Cette procédure sera effectuée en mode sans échec pour la majeure partie.
Je te conseille :
-Ou de l'imprimer et de cocher les actions effectuées au fur et à mesure.
-Ou de l'enregistrer sur le bureau avec le blocnote sous "Procédure.txt" par exemple, afin de pouvoir le consulter. 

Prends le temps de bien lire, d'appliquer ce qui est préconisé et si tu rencontres des difficultés, n'hésite pas à poser des questions.
Chaque phrase a son importance et il faut bien respecter cette procédure dans l'ordre pour agir efficacement.
Cependant, si tu rencontres un problème, saute une étape et informe-nous sur cette difficulté.

**Suppression de programmes**

Tu désinstalleras Antivir à la fin de la procédure part Ajout/Suppression des programmes.
Si tu préfères le garder désinstalle Avast avec cet utilitaire:
https://www.avast.com/fr-fr/uninstall-utility
C'est toi qui décide.
Tu désinstalles C:\Program Files\Macrogaming par Ajout/Suppression des programmes.


**A télécharger**

-"OTMoveIt " : http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe
Sur ton bureau.
Il ne nécessite pas d'installation

**Démarrage en mode sans échec**

Après la fermeture de la première fenêtre, au tout début de la phase de démarrage du PC (boot), appuyer sur F8.
Une fenêtre de type DOS s'ouvre, sélectionner Mode sans échec à l'aide des flèches du clavier et cliquer sur Entrée (Enter) une fois surligné.
Ne t'inquiète pas de l'aspect, Windows démarre avec le minimum nécessaire.
"Il faut choisir la même session que celle qui est infectée et non pas la sesssion Administrateur qui n'apparaît que sous ce mode."

**Arrêt, Suppression services inutiles ou intrus**

Dans Démarrer/Exécuter, tape "services.msc" et recherche ce(s) service(s) :

DomainService 
Microsoft cache control

Tu le(s) arrêtes et tu les désactives en cliquant dessus,  bouton Arrêter et menu dans Type de démarrage, Désactiver.

**Hijackthis**

Tu lances Hijackthis par le bouton "Scanner seulement/Scan only", selon la version et tu coches:

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {02A3EED1-7311-4B18-A515-CD125BF443D5} - C:\WINDOWS\system32\geeda.dll (file missing) 
O2 - BHO: {0ac69a99-10f2-1c0b-9514-b93d20bb53ce} - {ec35bb02-d39b-4159-b0c1-2f0199a96ca0} - C:\WINDOWS\system32\idfksnyd.dll (file missing) 
O2 - BHO: (no name) - {FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856} - C:\WINDOWS\system32\jkkkljk.dll (file missing) 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe 
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe 
O4 - HKCU\..\Run: [Gjsjaln] C:\WINDOWS\?ymbols\w?crtupd.exe 
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Jean Baptiste\Application Data\WinTouch\WinTouch.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') 

Tu cliques sur "Fixer objet/Fix checked" et tu refermes Hijackthis.

**Nettoyage**

Utilise OTMoveIt.
Pour cela ouvre-le:
Copie et colle la liste ci-dessous  dans le volet de gauche et clique sur "MoveIt!" pour lancer la suppression.

C:\WINDOWS\system32\idfksnyd.dll
C:\WINDOWS\?ymbols
C:\Documents and Settings\Jean Baptiste\Application Data\WinTouch
C:\WINDOWS\system32\pqtvngnu.exe
C:\WINDOWS\system32\windows

**Scan Antivir et AVG Antispyware**

Refais des scans sous ce mode et enregistre les rapports sur le bureau pour le retrouver

**Redémarrage en mode normal**

Poste les rapports AVG AntiSpyware, OTMoveIt, Antivir et un nouveau log Hijackthis établi en mode normal.
Donne des infos sur l'évolution de la situation et les problèmes éventuellement rencontrés lors de la procédure.

**Mises à jour à effectuer**

-Acrobat Reader :
https://get2.adobe.com/reader/otherversions/
Décoche Téléchargez également :Adobe Photoshop® Album Édition
Par Ajout/Suppression des programmes, désinstalle toutes les autres versions.


@+

job · Answer

Salut,

Tout s'est bien déroulé et je n'ai plus de messages d'erreurs. Apparement le problème et résolu, je t'envoie quand meme les rapports au cas ou tu trouves autres choses de "bizarres".

Merci encore beaucoup de ta précieuse aide.

Voici les différents rapports,

AntiVir PersonalEdition Classic
Report file date: lundi 24 décembre 2007 17:20

Scanning for 988313 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Jean Baptiste
Computer name: KAMOULOX

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 19:00:57
ANTIVIR2.VDF : 7.0.1.96 2048 Bytes 14/12/2007 19:00:57
ANTIVIR3.VDF : 7.0.1.144 227328 Bytes 23/12/2007 19:00:57
AVEWIN32.DLL : 7.6.0.46 3084800 Bytes 23/12/2007 19:00:58
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.2 360488 Bytes 23/12/2007 19:00:59
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: lundi 24 décembre 2007 17:20

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
13 processes with 13 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Boot sector 'E:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '31' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073658.exe
[DETECTION] Is the Trojan horse TR/Dldr.Agent.fjv
[INFO] The file was moved to '479ff357.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073659.exe
[DETECTION] Is the Trojan horse TR/Drop.Agent.ctu
[INFO] The file was moved to '46e2a608.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073660.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '479ff359.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073661.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '479ff358.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073662.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '46e28641.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073698.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '46e28642.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073723.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '479ff35a.qua'!
C:\System Volume Information\_restore{C2AE34AF-0134-4C27-8EF2-9A7FA2C29F7E}\RP528\A0073724.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '46e28643.qua'!
C:\VundoFix Backups\geeda.dll.bad
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47d4f395.qua'!
C:\VundoFix Backups\ihssxlvl.dll.bad
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47e2f399.qua'!
C:\VundoFix Backups\jkkkljk.dll.bad
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47daf39c.qua'!
C:\WINDOWS\system32\drivers\dtscsi.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd9965.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <Jeux>
Begin scan in 'E:\' <Vidéo>

End of the scan: lundi 24 décembre 2007 20:16
Used time: 2:55:15 min

The scan has been done completely.

14364 Scanning directories
452723 Files were scanned
11 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
11 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
452712 Files not concerned
2547 Archives were scanned
4 Warnings
1 Notes

OTMoveIT

File/Folder C:\WINDOWS\system32\idfksnyd.dll not found.
File/Folder C:\WINDOWS\?ymbols not found.
File/Folder C:\Documents and Settings\Jean Baptiste\Application Data\WinTouch not found.
File/Folder C:\WINDOWS\system32\pqtvngnu.exe not found.
C:\WINDOWS\system32\windows moved successfully.

Created on 12/24/2007 17:19:12

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:55:10, on 25/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Nettoyage\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-21-1409082233-1343024091-839522115-1003.bak\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')
O4 - S-1-5-21-1409082233-1343024091-839522115-1003.bak Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe (User '?')
O4 - Global Startup: NETGEAR WG311v2 Smart Configuration.lnk = C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Nettoyage\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\prohdy.html

nardino · Answer

Bonsoir.
Il te reste à désinstaller Antivir ou Avast, pâr Ajout/Suppression des programmes.
Ensuite tu lances OtMoveIt et tu cliques sur le bouton Cleanup.
Puis dans le popup Cleanup list download successful. Begin cleanup process ?, accepte par Yes.
Cela supprimera aussi tous les outils qui ont servi pour la désinfection.
Ton dernier rapport Hijackthis est propre.
As-tu fait la mise à jour de Adobe Reader ?

job · Answer

Bonjour,

Oui, j'ai fait la MAJ d'adobe, et nettoyer les outils de désinfections. Merci beaucoup pour la rapidité et l'efficacité de ton aide.

A très bientôt j'éspère (mais pas pour un problème de virus ^^.)

nardino · Answer

Re, Et n'oublie pas : un seul antivirus sur un pc

VirusKiller · Answer

Bonjour,

J'ai moi aussi chercher tout l'après midi comment virer ce virus, puis j'ai trouvé la solution.

J'avais un AntiSpyware efficace a l'époque, et après un formatage de mon PC je ne l'avais pas remis...

Donc après une après midi complète a chercher dans les registre, j'ai finalement décidé de Télécharger ce super logiciel: Spyware-Terminator et il a réglé le problème en 30 seconde chrono:
Un scan rapide, qui trouve tout les fichier en question, un reboot pour effacer les fichiers persistants et plus rien.

Je vous le conseil tous ;) Et bonne chance !

Virus

10 réponses

Discussions similaires

Newsletters