Plusieurs virus win32 :-((

Question

Bonjour à tous,

Je suis désolée de venir vous ennuyer alors qu'il y a de nombreux autres messages sur ces fichus virus mais depuis hier soir je lis les messages relatifs et j'avoue ne pas tout comprendre et avoir un peu peur de faire une fausse manip... J'ai des notions d'informatiques basiques, je m'en sers tous les jours comme nombre de personnes mais dès que ça devient un peu pointu, je ne saisis plus tout !

Donc voilà, j'ai mis recemment l'adsl sur le pc de mon copain qui n'avait pas vu le net depuis 2 ans. Il avait avast mais une version 2006... Il a aussi sur son PC "Zone Alarme" je ne sais pas trop ce que c'es, un "pare feu" apparemment, mais ça me demandait toutes les 2s d'autoriser ou refuser certains programmes et je crois bien que j'ai autorisé des choses que je n'aurais pas dues... 

J'ai donc bien entendu mis a jour avast et sa base virale, lancé un scan complet et minutieux et là aie aie aie un festival d'alertes en tout genres, que des virus win32 mais des adware, spyware et trojan (d'après leurs petits noms). Avast m'a conseillé de redémarrer le pc et de mettre un scan au démarrage. Je me suis donc exécutée et j'ai tout mis en quarantaine, même apparemment des "fichiers systèmes".

Le seul hic c'est bon le virus n'est pas supprimé d'une part et d'autre part j'ai l'impression qu'il y a encore des "fuites" vu que environ toutes les heures j'ai des alarmes et d'autres fichiers à mettre en quaranttaine ! 

Et est-ce la faute de ces vrus, le pc rame comme jamais et mes recherches internet s'affichent une fois sur 2 sinon la page reste blanche.

Bref, j'ai l'impression qu'il y a du boulot... Si quelqu'un de patient a l'amabilité de passer par là, je lui en serais grandement reconnaissante ! :o)))

shinobi80 · Answer

salut!
telecharge avg anti spyware.met a jour.dans onglet parametre appliquer toutes les actions clique supprimer et scan complet
a+

psgman94450 · Answer

Salut tu as un trés lourd problémé commence par désinstallé tout tes antivirus si t'en a et télécharge AntiVir https://www.01net.com/outils/telecharger/windows/Securite/antivirus-antitrojan/fiches/tele13198.html puis regarde sur ce site  pour t'aider a bien le configurer et a l'analyser correctemenent https://www.malekal.com/avira-free-security-antivirus-gratuit/ puis quand ta fini tu poste le rapport

Merci cordialement

jujudenis · Answer

ja avais avast et un cheval de troie et meme avg ou auytres ne m'en  on pas debarassé jte conseille KASPERSKY tu telechagre la version d essai grtuite c le seul qui m'a tout viré il ets super tu peux le trouver sur emule ou alors c plus sur pr eviter les virus tu va ssur le site officiel de Kaspersky sur google tu vas dans la rubrik de telechargements pouis tu choisi de telecharger la version d'essai gratutie Triple Protection tu installes et tu lances un scann et une fois fini tu en relances un et ceci juska ckil ne te trouve plus rien

bon courage

totram · Answer

salut, j'ai eu dernièrement un problème du même style,essaye de télécharger le prog. "elibagla" puis "combofix"(attention au moment d'enregistrer le fichier renomme le en antibeagle),
coupe ta connexion internet,supprime sous ie historique fichiers tmp etc,  lance elibagla (c:  eliminar ficheros auto  explorar)
une fois terminé lance combofix (antibeagle) cette intervention est très longue il faut la laisser jusqu'au bout.
voir si amélioration après le redémarrage, il est probable d'avoir a réinstaller la connexion internet, l'antivirus et le pare-feu qui peuvent être corrompus

jujudenis · Answer

lol fait ta promo moi jsuis allée demander a un exper chez boulanger et c un super antivirus dc jvois pas pk ma solution serait pas bonne
javais contaminé tous mes contactz msn et ils l ont tous viré grace a kaspersky

jujudenis · Answer

et bien je ndis la meme chose 'j ai fait ce que j'ai écrit et ca marche " lol ;)

jujudenis · Answer

lol ;)

NAINA11 · Answer

EST-CE QU'ON PEUX INSTALLER UN ANTIVIRUS ET UN ANTI-SPYWARE EN MEME TEMPS
OU EST LA DIFFERENCE ENTRE LES DEUX
MERCI DE ME REPONDRE

MissLili · Answer

Oula merci pour vos réponses ! J'ai suivi un des premiers avis (je n'avais pas vu tous les autres) : j'ai viré avast et installé antivir. il m'a trouvé 127 trucs infectés !!!

Voici le rapport :



AntiVir PersonalEdition Classic
Report file date: dimanche 30 mars 2008  15:56

Scanning for 1169688 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 1)  [5.1.2600]
Username:         SYSTEM
Computer name:    NICOLAS-COSJANO

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 12:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 11:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 14:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 11:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 13:27:15
ANTIVIR1.VDF : 7.0.3.2     5447168 Bytes  07/03/2008 13:55:55
ANTIVIR2.VDF : 7.0.3.85     434176 Bytes  27/03/2008 13:55:55
ANTIVIR3.VDF : 7.0.3.92      20480 Bytes  28/03/2008 13:55:55
AVEWIN32.DLL : 7.6.0.78    3408384 Bytes  30/03/2008 13:55:55
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 09:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 06:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 12:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes  30/03/2008 13:55:55
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 06:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 11:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 06:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 10:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 11:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 11:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 08:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: J:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 30 mars 2008  15:56

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'taskmgr.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned
Scan process 'jgemsnu.exe' - '1' Module(s) have been scanned
  Module is infected -> 'C:\WINDOWS\System32\jgemsnu.exe'
Scan process 'RAC12.exe' - '1' Module(s) have been scanned
Scan process 'MediaDico12.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'SPUVolumeWatcher.exe' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'LWEMon.exe' - '1' Module(s) have been scanned
Scan process 'Gestionnaire Antidote.exe' - '1' Module(s) have been scanned
Scan process 'PRHYPER.EXE' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'udbaehms.exe' - '1' Module(s) have been scanned
  Module is infected -> 'C:\WINDOWS\System32\udbaehms.exe'
Scan process 'explorer.exe' - '1' Module(s) have been scanned
  Module is infected -> 'C:\WINDOWS\System32\explorer.exe'
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'Isass.exe' - '1' Module(s) have been scanned
  Module is infected -> 'C:\WINDOWS\System32\Isass.exe'
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'sstray.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
Process 'jgemsnu.exe' has been terminated
Process 'udbaehms.exe' has been terminated
Process 'explorer.exe' has been terminated
Process 'Isass.exe' has been terminated
C:\WINDOWS\System32\jgemsnu.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '48549c9d.qua'!
C:\WINDOWS\System32\udbaehms.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '48519c9d.qua'!
C:\WINDOWS\System32\explorer.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485f9cb4.qua'!
C:\WINDOWS\System32\Isass.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '48509cb0.qua'!

43 processes with 39 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'J:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
C:\WINDOWS\system32\awtqnkhe.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\awtqnkhe.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen

The registry was scanned ( '37' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\FXICBUWG\CANQY17V
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '483d9ccb.qua'!
C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\K36UQ28Q\CAUJ4PMJ
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '48449cd6.qua'!
C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\K36UQ28Q\hctp[1]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '48639cfb.qua'!
C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\K5TTNHDB\CA5WUTHN
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '48249cdf.qua'!
C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\K5TTNHDB\CADSKB9T
      [DETECTION] Is the Trojan horse TR/Vundo.AG
      [INFO]      The file was moved to '48339ce1.qua'!
C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\K5TTNHDB\ptch[1]
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '48529d1e.qua'!
C:\Program Files\MUSK Codec Pack v5\5.1\5.1.exe
      [DETECTION] Contains detection pattern of the dropper DR/Gator.3202
      [INFO]      The file was moved to '4820a18f.qua'!
C:\System Volume Information\_restore{54F796E9-EBC5-4EB8-A477-CB72A2FA9017}\RP175\A0033018.exe
      [DETECTION] Contains detection pattern of the worm WORM/Rbot.XFC
      [INFO]      The file was moved to '481fa304.qua'!
C:\System Volume Information\_restore{54F796E9-EBC5-4EB8-A477-CB72A2FA9017}\RP175\A0033019.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '481fa307.qua'!
C:\System Volume Information\_restore{54F796E9-EBC5-4EB8-A477-CB72A2FA9017}\RP175\A0033020.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AG
      [INFO]      The file was moved to '481fa30d.qua'!
C:\System Volume Information\_restore{54F796E9-EBC5-4EB8-A477-CB72A2FA9017}\RP176\A0034168.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '481fa317.qua'!
C:\System Volume Information\_restore{54F796E9-EBC5-4EB8-A477-CB72A2FA9017}\RP176\A0034169.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '481fa31c.qua'!
C:\System Volume Information\_restore{54F796E9-EBC5-4EB8-A477-CB72A2FA9017}\RP176\A0034170.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '481fa31e.qua'!
C:\System Volume Information\_restore{54F796E9-EBC5-4EB8-A477-CB72A2FA9017}\RP176\A0034171.exe
      [DETECTION] Contains detection pattern of the dropper DR/Gator.3202
      [INFO]      The file was moved to '481fa321.qua'!
C:\WINDOWS\system32\awctq.exe
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a499.qua'!
C:\WINDOWS\system32\awtqnkhe.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\awtsqqnl.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4863a4ab.qua'!
C:\WINDOWS\system32\awtuursq.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4863a4ae.qua'!
C:\WINDOWS\system32\awtuutqp.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4863a4b4.qua'!
C:\WINDOWS\system32\bczp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4869a4a2.qua'!
C:\WINDOWS\system32\bqem.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4854a4b2.qua'!
C:\WINDOWS\system32\bqlcnzup.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485ba4b5.qua'!
C:\WINDOWS\system32\brbmazz.exe
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4851a4b8.qua'!
C:\WINDOWS\system32\bthzhqtr.exe
      [DETECTION] Is the Trojan horse TR/NoUpdate.B.44
      [INFO]      The file was moved to '4857a4bc.qua'!
C:\WINDOWS\system32\byxuvspq.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4867a4c4.qua'!
C:\WINDOWS\system32\byxxvust.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4867a4c6.qua'!
C:\WINDOWS\system32\byxxwvsp.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4867a4c7.qua'!
C:\WINDOWS\system32\byxxwxus.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4867a4c9.qua'!
C:\WINDOWS\system32\cbxxwxvt.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4867a4b4.qua'!
C:\WINDOWS\system32\cbxyaywx.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4867a4b5.qua'!
C:\WINDOWS\system32\cdfk.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4855a4b9.qua'!
C:\WINDOWS\system32\ddccyxyv.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4c1.qua'!
C:\WINDOWS\system32\dikfc.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485aa4c8.qua'!
C:\WINDOWS\system32\dkycbriv.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4868a4cd.qua'!
C:\WINDOWS\system32\drayjko.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4850a4de.qua'!
C:\WINDOWS\system32\dsoa.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485ea4e1.qua'!
C:\WINDOWS\system32\dyjiy.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4859a4ea.qua'!
C:\WINDOWS\system32\efcaaayx.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4db.qua'!
C:\WINDOWS\system32\efcaxywv.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4dd.qua'!
C:\WINDOWS\system32\efcdaaxv.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4df.qua'!
C:\WINDOWS\system32\efcdbyyy.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4e1.qua'!
C:\WINDOWS\system32\fccabyvv.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4e0.qua'!
C:\WINDOWS\system32\fccdbcyx.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4e3.qua'!
C:\WINDOWS\system32\fccyabcc.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4852a4e5.qua'!
C:\WINDOWS\system32\fjmjlipd.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485ca4ed.qua'!
C:\WINDOWS\system32\ftkkcqx.exe
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485aa4fa.qua'!
C:\WINDOWS\system32\fxck.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4852a4ff.qua'!
C:\WINDOWS\system32\gebaaxvs.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4851a4ee.qua'!
C:\WINDOWS\system32\gebxxuur.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4851a4f0.qua'!
C:\WINDOWS\system32\gebyvwxw.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4851a4f1.qua'!
C:\WINDOWS\system32\gebyywwv.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4851a4f3.qua'!
C:\WINDOWS\system32\gowk.exe
      [DETECTION] Is the Trojan horse TR/NoUpdate.B.44
      [INFO]      The file was moved to '4866a4ff.qua'!
C:\WINDOWS\system32\hgggeccc.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4856a4f9.qua'!
C:\WINDOWS\system32\hjvxpead.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4865a4fe.qua'!
C:\WINDOWS\system32\jase.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4862a4fa.qua'!
C:\WINDOWS\system32\jkkhigde.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485aa506.qua'!
C:\WINDOWS\system32\jkkjklii.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485aa508.qua'!
C:\WINDOWS\system32\jkkjklmj.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485aa509.qua'!
C:\WINDOWS\system32\jkkllkif.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485aa50b.qua'!
C:\WINDOWS\system32\jowcihje.exe
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4866a511.qua'!
C:\WINDOWS\system32\khfcbyvu.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4855a50d.qua'!
C:\WINDOWS\system32\khfdcdde.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4855a50f.qua'!
C:\WINDOWS\system32\khfddaaa.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4855a510.qua'!
C:\WINDOWS\system32\khfddefe.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4855a512.qua'!
C:\WINDOWS\system32\khfgffdb.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\kkgnrrd.exe
      [DETECTION] Contains detection pattern of the worm WORM/IrcBot.36864.20
      [INFO]      The file was moved to '4856a51f.qua'!
C:\WINDOWS\system32\ktgpky.exe
      [DETECTION] Is the Trojan horse TR/NoUpdate.B.44
      [INFO]      The file was moved to '4856a52b.qua'!
C:\WINDOWS\system32\kwkfkk.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485aa530.qua'!
C:\WINDOWS\system32\lgrzex.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4861a522.qua'!
C:\WINDOWS\system32\ljjgffgf.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4859a527.qua'!
C:\WINDOWS\system32\ljjiifgh.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4859a529.qua'!
C:\WINDOWS\system32\lqmt.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485ca532.qua'!
C:\WINDOWS\system32\munifl.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485da540.qua'!
C:\WINDOWS\system32
nnlmnon.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485da53c.qua'!
C:\WINDOWS\system32
nnommnl.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485da542.qua'!
C:\WINDOWS\system32
ogglaiy.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4856a545.qua'!
C:\WINDOWS\system32\ohdvl.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4853a542.qua'!
C:\WINDOWS\system32\opnkijge.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485da54d.qua'!
C:\WINDOWS\system32\opnlmlmj.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485da54f.qua'!
C:\WINDOWS\system32\opnnljhh.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485da550.qua'!
C:\WINDOWS\system32\pmnkhfef.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '49d44721.qua'!
C:\WINDOWS\system32\pmnkkjif.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\pqbvf.exe
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4851a55c.qua'!
C:\WINDOWS\system32\qommmjkh.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485ca55d.qua'!
C:\WINDOWS\system32\qomnlklj.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '485ca55e.qua'!
C:\WINDOWS\system32bpbag.exe
      [DETECTION] Contains detection pattern of the worm WORM/IrcBot.36864.20
      [INFO]      The file was moved to '485fa554.qua'!
C:\WINDOWS\system32qrpqpnl.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4861a566.qua'!
C:\WINDOWS\system32rsrwcfl.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4862a568.qua'!
C:\WINDOWS\system32yfhu.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4855a571.qua'!
C:\WINDOWS\system32\ssqrqron.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4860a571.qua'!
C:\WINDOWS\system32	uvsrppq.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4865a577.qua'!
C:\WINDOWS\system32\uagflhgi.exe
      [DETECTION] Is the Trojan horse TR/NoUpdate.B.44
      [INFO]      The file was moved to '4856a566.qua'!
C:\WINDOWS\system32\urqoolli.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4860a579.qua'!
C:\WINDOWS\system32\uvli.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485ba580.qua'!
C:\WINDOWS\system32\vidyvzyb.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4853a575.qua'!
C:\WINDOWS\system32\vinqk.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485da577.qua'!
C:\WINDOWS\system32\vturppon.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4864a584.qua'!
C:\WINDOWS\system32\vtutropm.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4864a586.qua'!
C:\WINDOWS\system32\vtutsppo.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4864a587.qua'!
C:\WINDOWS\system32\wekhhakc.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485aa57a.qua'!
C:\WINDOWS\system32\wkkdstj.exe
      [DETECTION] Is the Trojan horse TR/NoUpdate.B.44
      [INFO]      The file was moved to '485aa584.qua'!
C:\WINDOWS\system32\wvutsrst.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4864a593.qua'!
C:\WINDOWS\system32\wvututuu.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4864a594.qua'!
C:\WINDOWS\system32\wvuuuust.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4864a596.qua'!
C:\WINDOWS\system32\wwlhyj.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '485ba599.qua'!
C:\WINDOWS\system32\xffczeai.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4855a58a.qua'!
C:\WINDOWS\system32\xoaednzx.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4850a595.qua'!
C:\WINDOWS\system32\xquxilb.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4864a59f.qua'!
C:\WINDOWS\system32\xxyxxvuu.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4868a5a9.qua'!
C:\WINDOWS\system32\xxyywtrr.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4868a5ab.qua'!
C:\WINDOWS\system32\yayyyvsq.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4868a596.qua'!
C:\WINDOWS\system32\yulfr.exe
      [DETECTION] Is the Trojan horse TR/NoUpdate.B.44
      [INFO]      The file was moved to '485ba5ac.qua'!
C:\WINDOWS\system32\yzwscpz.exe
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '4866a5b3.qua'!
C:\WINDOWS\system32\zodmxtd.exe
      [DETECTION] Is the Trojan horse TR/NoUpdate.B.44
      [INFO]      The file was moved to '4853a5aa.qua'!
C:\WINDOWS\system32\zrga.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4856a5af.qua'!
C:\WINDOWS\system32\ztpaf.exe
      [DETECTION] Contains detection pattern of the worm WORM/IrcBot.36864.20
      [INFO]      The file was moved to '485fa5b6.qua'!
C:\WINDOWS\system32\zusbqahx.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4862a5ba.qua'!
C:\WINDOWS\system32\zwuipked.exe
      [DETECTION] Contains detection pattern of the worm WORM/IrcBot.36864.20
      [INFO]      The file was moved to '4864a5be.qua'!
C:\WINDOWS\system32\drivers\atapi.sys
      [WARNING]   The file could not be opened!
Begin scan in 'J:\' <DONNEES>


End of the scan: dimanche 30 mars 2008  16:40
Used time: 43:57 min

The scan has been done completely.

   3622 Scanning directories
 219270 Files were scanned
    127 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
    119 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 219143 Files not concerned
   1230 Archives were scanned
      6 Warnings
      3 Notes

Merci !

MissLili · Answer

Sur les conseils d'un inge informaticien j'ai également installé spybot et ad aware. Je suis en train d'installer ad aware mais spybot me fait un truc bizarre, je me demande s'il n'est pas infecté aussi :S

psgman94450 · Answer

c'est pas grave mais supprime les fichiers qui sont en quarantaine regarde le tutoriel

dou-l · Answer

Ok

T'es infécter par vundo 


Fait ce qui suit stp


Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

MissLili · Answer

Ok merci je lis tout ça et je vais supprimer.

En revanche j'ai l'impression que mon PC meurt à petit feu snif.... Depuis 5mn antivir me met une alerte tour a tour pour un truc comme "Vundo.Gen" et puis "TR/Crypt.XPACK.Gen", et là il ne s'arrete plus, dès que j'en supprime un la suivante s'ouvre automatiquement :SSS

dou-l · Answer

Ok fait la manip avec vundo stp

dou-l · Answer

Tu suis qui la  . ?

dou-l · Answer

Non c'est normal vunodfix peut ne rien trouver .


Téléchargez VirtumundoBeGone sur votre bureau.

Double-cliquez ensuite sur VirtumundoBeGone.exe et suivez les instructions qui s'affichent à l'écran.

Une fois terminé, redémarrez votre PC.

PS : Ne vous inquiètez pas si vous voyez un écran bleu "Erreur fatale", c'est normal.


Télécharges ComboFix à partir d'un de ces liens :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

&#9658; Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

&#9658; Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.


Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

&#9658; Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

&#9658; Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

@+

dou-l · Answer

psgman je prefere qu'une personne continue la desinfection car elle ne va pas si retrouver. Antivir ne supprimera rien il informe juste .

dou-l · Answer

Nan c'est pas de ta faute. C'est a cause de ces virus ^^

dou-l · Answer

ok  a tout de suite

MissLili · Answer

En tout cas les fenêtres intempestives de Antivir au sujet dudit Vendo et qui ne s'arrêtaient pas n'ont pas reparues !! Je savoure ! :))))

J'imagine qu'il faudra refaire un scan complet de la bestiole pour voir s'il ne me trouve pas autre chose. Paske yavait Vendo plus un autre petit rigolo en alternance, mais c'était peut être juste un de ses acolytes :P

dou-l · Answer

Refait un scan antivir stp

dou-l · Answer

Ok 

Ne fais pas antivir excuse lol 


Fait un scan online avec bitdefender et poste le rapport.

http://www.bitdefender.fr/scan_fr/scan8/ie.html

Ps; Faut allez sur Ie pour le faire

dou-l · Answer

Bon je dois y aller je verrai si il reste des bebetes demain aprem 


a+.

dou-l · Answer

re

Télécharge sur le bureau hijackthis


Fait un clic droit sur l'icone hijackthis.


/!\Renome hijackthis en skim.exe ( a le place de hijacktihs.exe) c'est important!!/!\

*Après avoir fais ca double-clic dessus.

*Clic sur Do a system scan and save the log

*A la fin de l'analyse un rapport va etre générer colle le ici.

Une démo d'hijackthis

dou-l · Answer

les deux c'est mieux

dou-l · Answer

je verai demain

la j'ai pas le temp mais bn ton probleme ets résolu non ?


l'executable

dou-l · Answer

Hijackthis sert a diagnostiquer ton pc 

fix ces ligne avec hijackthis

O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\Isass.exe 

O2 - BHO: (no name) - {139B5C6B-2B66-45AE-BDA6-14C1B18CC68D} - C:\WINDOWS\System32\yaywxusr.dll (file missing) 


tu coche la croix a coté et tu clique sur fix checkced

ta version IE est pas bonne télécharge  IE7


Puis ta version windows est obsolete utilise la sp2 : regarde le lien http://mi.cnrs-orleans.fr/Updates/WinXP/Sp2/WinXP_Sp2.htm

dou-l · Answer

recolle un log hijack stp

Plusieurs virus win32 :-((

28 réponses

Discussions similaires

Newsletters