Probleme vundo et spyware
Bonjour,
salut j ne comprend plus rien je suis infcté par des virus harwaes et spywares. j'ai telechargé avast qui m'a fait le menage mais je garde encore TR/vundo.gen alors d frum en forum j'ai pu tester plusieur chose qui ne marche pas. j'ai telechargé vundofix rien a faire il est encore la, le programme ne le detecte meme pas. ensuite j'ai telechargé hijhackthis et fais tout cequ'il y as sur les forum mais il est encore la. je ne sait plus quoi faire. e bien que j'ai un antivirs les spyware persiste. aidez moi s'il vous plait. je suis sur vista
salut j ne comprend plus rien je suis infcté par des virus harwaes et spywares. j'ai telechargé avast qui m'a fait le menage mais je garde encore TR/vundo.gen alors d frum en forum j'ai pu tester plusieur chose qui ne marche pas. j'ai telechargé vundofix rien a faire il est encore la, le programme ne le detecte meme pas. ensuite j'ai telechargé hijhackthis et fais tout cequ'il y as sur les forum mais il est encore la. je ne sait plus quoi faire. e bien que j'ai un antivirs les spyware persiste. aidez moi s'il vous plait. je suis sur vista
Configuration: Windows Vista Internet Explorer 7.0
27 réponses
Résumé de la discussion
Le fil traite d'une infection par le Trojan.Vundo et de spyware persistants sous Windows Vista tandis que l'utilisateur teste plusieurs outils (Avast, Vundofix, HijackThis) sans éliminer complètement le malware. La meilleure réponse préconise de redémarrer et de relancer ComboFix pour assurer une suppression complète, les tests montrant que Malwarebytes peut détecter des éléments nuisibles mais laisse parfois des restes. D'autres contributions évoquent des nettoyages avec Malwarebytes, puis l'utilisation répétée de ComboFix, tout en notant l'importance des redémarrages et des suppressions de composants malveillants. En pratique, la discussion illustre une étape intermédiaire fréquente dans les guides de sécurité: combiner outils anti-malware, relancer les scans et vérifier les restes inscrits dans les clés de registre et les emplacements Run.
-
ModérateurAh oui, c'est mieux, par contre :
---> Désinstalle Avast et installe Antivir (français et bien plus efficace) :
http://dl1.avgate.net/down/windows/antivir_workstation_winu_fr_h.exe -
ca va mieux????
-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:53:57, on 29/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\RunOnce: [x64setup] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow\default /v isSubtitles /t REG_DWORD /d 1 /f
O4 - HKCU\..\RunOnce: [x64setup2] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" regsvr32.exe /S "%programfiles%\VistaCodecPack\filters\MatroskaSplitter.ax"
O4 - HKCU\..\RunOnce: [x64setup3] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.dts" /f
O4 - HKCU\..\RunOnce: [x64setup4] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG DELETE "HKCR\Media Type\Extensions\.ac3" /f
O4 - HKCU\..\RunOnce: [x64setup1] cmd.exe /Q /c If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow_audio /v ac3 /t REG_DWORD /d 15 /f
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {01FEFFF9-5B35-F3E0-091B-FF808CF511AE} - http://download.pcprivacycleaner.com/PCPC_Setup_Free_fr.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1219059033940&h=0f6033b74a95b94507c431c1a1f31603/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
-
ModérateurAvec la nouvelle version d'HijackThis, ça serait mieux.
-
(( je m'incruste de nouveau, mais ca joue peut etre :
Logfile of HijackThis v1.99.1
:/
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
Tuto : https://www.androidworld.fr/
)) -
Logfile of HijackThis v1.99.1
Scan saved at 13:46:57, on 29/08/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Users\admin\AppData\Local\Temp\Rar$EX00.871\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {01FEFFF9-5B35-F3E0-091B-FF808CF511AE} - http://download.pcprivacycleaner.com/PCPC_Setup_Free_fr.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1219059033940&h=0f6033b74a95b94507c431c1a1f31603/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing) -
ModérateurNon.
-
toi tu doit avoir emul je suppose
-
Modérateur---> Relance MBAM, va dans Quarantaine et supprime tout
---> Poste un nouveau rapport HijackThis -
je m'en sert pour remplacer emul. ca va 10 fois plus vite. bitlord, bitcomet. en tout cas moi je prefere
-
tout va bien plus de souci merci beaucoup pour ton aide.
-
ModérateurEmulateur de quoi ?
-
oui c'est mon emulateur
-
ModérateurBitLord, ça te dit quelque chose ?
-
ModérateurJe me renseigne par rapport à un logiciel.
-
voici
ComboFix 08-08-28.06 - admin 2008-08-29 12:42:03.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1470 [GMT 2:00]
Endroit: C:\Users\admin\Desktop\download\Programme\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\wurhspoi.ini
.
---- Previous Run -------
.
C:\Program Files\PCHealthCenter
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\PCPrivacyCleaner
C:\Users\admin\AppData\Roaming\rhc3njj0ej6c
C:\Windows\eekv.exe
C:\Windows\etbr.exe
C:\Windows\system32\wurhspoi.ini
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.
2008-08-29 12:24 . 2008-08-29 12:24 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-08-29 12:24 . 2008-08-29 12:24 <REP> d-------- C:\Users\admin\AppData\Roaming\Malwarebytes
2008-08-29 12:24 . 2008-08-29 12:24 <REP> d-------- C:\ProgramData\Malwarebytes
2008-08-29 12:24 . 2008-08-29 12:24 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-29 12:24 . 2008-08-17 15:01 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-29 12:24 . 2008-08-17 15:01 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-29 11:56 . 2008-08-29 12:45 175,052,389 --a------ C:\Windows\MEMORY.DMP
2008-08-29 09:27 . 2008-08-29 09:51 <REP> d-a------ C:\Users\All Users\TEMP
2008-08-29 09:27 . 2008-08-29 09:51 <REP> d-a------ C:\ProgramData\TEMP
2008-08-27 21:50 . 2008-08-27 21:50 <REP> d-------- C:\VundoFix Backups
2008-08-27 20:47 . 2008-08-27 20:47 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-08-27 16:39 . 2008-08-27 16:39 <REP> d-------- C:\Program Files\Alwil Software
2008-08-27 16:39 . 2008-07-19 16:36 51,280 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-08-27 14:56 . 2008-08-27 14:56 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-08-27 14:35 . 2008-08-29 12:33 <REP> d-------- C:\Program Files\MSA
2008-08-25 14:00 . 2008-08-25 14:00 0 --a------ C:\Windows\System32\C4B5.tmp
2008-08-24 19:56 . 2008-08-24 19:59 <REP> d-------- C:\Users\All Users\Lavasoft
2008-08-24 19:56 . 2008-08-24 19:59 <REP> d-------- C:\ProgramData\Lavasoft
2008-08-24 19:56 . 2008-08-24 19:56 <REP> d-------- C:\Program Files\Lavasoft
2008-08-24 14:32 . 2008-08-24 16:26 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-08-24 14:32 . 2008-08-24 16:26 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-08-23 21:11 . 2008-08-23 21:11 <REP> d-------- C:\Users\All Users\eMule
2008-08-23 21:11 . 2008-08-23 21:11 <REP> d-------- C:\ProgramData\eMule
2008-08-22 10:26 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-08-22 10:26 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-08-22 10:26 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
2008-08-22 10:26 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-08-22 10:26 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
2008-08-22 10:26 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-08-22 10:26 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-08-22 10:26 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
2008-08-22 10:26 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-08-18 13:30 . 2008-08-18 13:31 <REP> d-------- C:\Program Files\Java
2008-08-18 13:29 . 2008-08-18 13:29 <REP> d-------- C:\Program Files\Common Files\Java
2008-08-14 13:58 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-14 11:55 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-14 11:55 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-14 11:55 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-14 11:55 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-14 11:55 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-08 21:40 . 2008-08-08 21:40 <REP> dr------- C:\Windows\System32\config\systemprofile\Videos
2008-08-08 21:40 . 2008-08-08 21:40 <REP> dr------- C:\Windows\System32\config\systemprofile\Searches
2008-08-08 21:40 . 2008-08-08 21:40 <REP> dr------- C:\Windows\System32\config\systemprofile\Saved Games
2008-08-08 21:40 . 2008-08-08 21:40 <REP> dr------- C:\Windows\System32\config\systemprofile\Pictures
2008-08-08 21:40 . 2008-08-08 21:40 <REP> dr------- C:\Windows\System32\config\systemprofile\Links
2008-08-08 21:40 . 2008-08-08 21:40 <REP> dr------- C:\Windows\System32\config\systemprofile\Downloads
2008-08-08 21:40 . 2008-08-25 13:55 <REP> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-08-08 21:15 . 2008-08-08 21:15 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-08-08 21:12 . 2008-08-08 21:12 <REP> d-------- C:\Program Files\Microsoft.NET
2008-08-08 21:08 . 2008-08-08 21:08 <REP> dr-h----- C:\MSOCache
2008-08-04 02:14 . 2008-08-04 02:14 <REP> d-------- C:\Windows\Watson
2008-08-03 23:17 . 2008-08-03 23:17 <REP> d-------- C:\Users\All Users\Ubisoft
2008-08-03 23:17 . 2008-08-03 23:17 <REP> d-------- C:\ProgramData\Ubisoft
2008-08-03 01:43 . 2007-11-08 11:04 11,967,524 --a------ C:\Windows\System32\korwbrkr.lex
2008-08-02 23:40 . 2008-08-02 23:40 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-08-02 23:37 . 2008-08-17 19:05 <REP> d-------- C:\Users\admin\AppData\Roaming\DAEMON Tools
2008-08-02 23:37 . 2008-08-02 23:37 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
2008-07-31 20:29 . 2008-07-31 20:29 <REP> d-------- C:\PerfLogs
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 07:43 --------- d-----w C:\Users\admin\AppData\Roaming\DNA
2008-08-27 19:48 --------- d-----w C:\ProgramData\NVIDIA
2008-08-27 13:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-25 12:53 --------- d-----w C:\Program Files\DivX
2008-08-25 11:24 --------- d-----w C:\Program Files\BitLord
2008-08-24 13:42 --------- d-----w C:\Program Files\Packard Bell
2008-08-18 14:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 11:59 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-14 11:56 --------- d-----w C:\Program Files\Windows Mail
2008-08-08 19:43 --------- d-----w C:\ProgramData\Roxio
2008-08-08 19:35 --------- d-----w C:\Program Files\Microsoft Works
2008-08-08 19:30 2,756 ----a-w C:\Users\admin\AppData\Roaming\wklnhst.dat
2008-08-08 19:15 --------- d-----w C:\Program Files\MSBuild
2008-08-04 00:14 --------- d-----w C:\Program Files\Microsoft Games
2008-07-31 18:36 174 --sha-w C:\Program Files\desktop.ini
2008-07-31 18:30 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-31 18:30 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-07-31 18:30 --------- d-----w C:\Program Files\Windows Journal
2008-07-31 18:30 --------- d-----w C:\Program Files\Windows Defender
2008-07-31 18:30 --------- d-----w C:\Program Files\Windows Collaboration
2008-07-31 18:30 --------- d-----w C:\Program Files\Windows Calendar
2008-07-27 23:42 --------- d-----w C:\Users\admin\AppData\Roaming\Yahoo!
2008-07-18 18:39 587,264 ----a-w C:\Windows\WLXPGSS.SCR
2008-07-03 11:30 --------- d-----w C:\Program Files\HDReg
2008-07-03 01:14 --------- d-----w C:\Users\admin\AppData\Roaming\ItsLabel
2008-07-03 01:12 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-07-03 01:10 --------- d-----w C:\Users\admin\AppData\Roaming\EoRezo
2008-06-28 01:02 --------- d-----w C:\Program Files\Windows Live
2008-06-27 01:08 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-06-27 01:08 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-06-27 01:08 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-06-27 01:08 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 05:28 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 05:28 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 05:28 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 17:10 4468736 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-05-07 18:51 1826816 C:\Windows\SkyTel.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A0EA457A-C9EF-45C1-B776-8C688A1AE10B}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{90DC3733-8D8F-427F-AC18-AD54A07FA845}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{A095BF4C-2E74-461E-8B9D-B451778DFEC0}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{0D60B5F1-1981-4411-AD37-9EA96A6E23C5}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{FF6AE0D4-CF04-49F9-A7EB-85D7A8A0A511}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{DB599D5E-0F13-4B4F-A439-392313A8B2E4}C:\\program files\\bitlord\\bitlord.exe"= UDP:C:\program files\bitlord\bitlord.exe:BitLord
"UDP Query User{2002D52D-2866-46C3-A554-820357EF3497}C:\\program files\\bitlord\\bitlord.exe"= TCP:C:\program files\bitlord\bitlord.exe:BitLord
"TCP Query User{2FE21B75-FB29-4317-926A-6A912BECFD8E}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{9CFD23A6-EC51-4C16-9AF4-B4F90EFE5AF0}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{8BBF2B42-952E-4112-B006-D23DF88C4667}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{35E6548E-9A9E-4F95-AAEC-DC0DFD55C2B9}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{5DCE8119-8185-4075-A85B-583D317E07F8}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{E53938A8-F77E-4647-A303-9E6440B40D17}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{C4F9813A-4826-465E-938D-2741ABD535EC}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{7D373036-AD87-4F1A-9483-1A8A938F591D}C:\\users\\admin\\program files\\dna\\btdna.exe"= Disabled:UDP:C:\users\admin\program files\dna\btdna.exe:btdna.exe
"UDP Query User{47C6FE6B-D6BA-45C8-8555-9D0C38394F71}C:\\users\\admin\\program files\\dna\\btdna.exe"= Disabled:TCP:C:\users\admin\program files\dna\btdna.exe:btdna.exe
"{FE42DE9C-F433-482C-B2A7-19FF48A423D4}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{142F32E1-B2C9-4D40-A5FF-012368E8775D}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>Ý\†Ð=ŸàÛ±Þ"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\program files\\bcd_installed.exe"= c:\program files\bcd_installed.exe:*:Enabled:Windows Application Service
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 16:36]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10266b24-f7e0-11dc-856e-001d7d23adce}]
\shell\AutoRun\command - J:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{604bef8d-60db-11dd-a29c-001d7d23adce}]
\shell\AutoRun\command - I:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ad1aaa57-f97a-11dc-a240-001d7d23adce}]
\shell\AutoRun\command - J:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -
Toolbar-{18C388BB-5014-4906-AE38-E62BA5AA7387} - (no file)
Toolbar-{FA9CBCB5-3330-4AF1-A2A3-30FE4C366215} - (no file)
WebBrowser-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
HKLM-Run-Ad-Watch - C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
ShellExecuteHooks-{74CE56FF-3469-47C0-93E1-D0CB8B203EA9} - (no file)
ShellExecuteHooks-{FEEAD861-8455-42F3-8A7E-B7756084BB36} - C:\Windows\system32\nnnnOeBT.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R0 -: HKLM-Main,Start Page = hxxp://fr.yahoo.com
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O16 -: {01FEFFF9-5B35-F3E0-091B-FF808CF511AE} - hxxp://download.pcprivacycleaner.com/PCPC_Setup_Free_fr.exe
.
.
------- File Associations (Beta) -------
.
regfile=regedit.exe "%1" %*
scrfile="%1" %*
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 12:46:16
Windows 6.0.6001 Service Pack 1 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 12:49:44 - machine was rebooted [admin]
ComboFix-quarantined-files.txt 2008-08-29 10:49:32
Pre-Run: 338,091,085,824 octets libres
Post-Run: 338,027,012,096 octets libres
224 --- E O F --- 2008-08-27 18:51:27 -
Modérateur---> Redémarre et refais ComboFix
-
Modérateur---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm-
Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1094
Windows 6.0.6001 Service Pack 1
12:33:32 2008-08-29
mbam-log-08-29-2008 (12-33-32).txt
Type de recherche: Examen rapide
Eléments examinés: 41749
Temps écoulé: 2 minute(s), 39 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 19
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 4
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 28
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
C:\Users\admin\AppData\Local\Temp\urqNFvvV.dll (Trojan.Vundo.H) -> Delete on reboot.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d1bcf236-5f7a-4cda-afbf-efd707442580} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{d1bcf236-5f7a-4cda-afbf-efd707442580} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27e1f636-2037-4878-8a0f-8b42b8e52c28} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{27e1f636-2037-4878-8a0f-8b42b8e52c28} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{6d0111e3-3060-4d23-b2bc-42ed86cbe9a3} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc3njj0ej6c (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhc3njj0ej6c (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Casino Tropez (Adware.Casino) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Casino Tropez (Adware.Casino) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qalkfxor.bgrm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qalkfxor.bpqk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qalkfxor.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cba10d10-741a-33e9-b1a9-f49fb0409dee} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cba10d10-741a-33e9-b1a9-f49fb0409dee} (Trojan.BHO) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\vieae48.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\vieb460.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\vieb9fb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\vie39b5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc7njj0ej6c (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc3njj0ej6c (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\users\admin\appdata\local\temp\urqnfvvv -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\users\admin\appdata\local\temp\urqnfvvv -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Users\admin\AppData\Local\Temp\urqNFvvV.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Users\admin\AppData\Local\Temp\VvvFNqru.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\VvvFNqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\awtqnkhe.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\Windows\eekv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\etbr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\ltjkxdok.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\acdnrxtg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\bqgqmaqv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\giwdyoqf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\oadtaqom.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\pjmktwlt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\pmnoNFus.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\qoMcbCSI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\qoMdBTmj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\sklbsfwl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\ssqoljJC.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\vbhdttrd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\xxyawuSI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\yayyAtQG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\MSA\msa0.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MSA\msa1.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MSA\MSA.cpl (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Windows\System32\MSA.cpl (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Windows\System32\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\admin\AppData\Local\Temp\sflpt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
-
-
combofix a ouvert le panneau de commande a fait le netoyage e a redemmaré l'ordi. mais aumoment du demarrage windows m'a demandé comment je voulai redemarrer( j'ai choisi nrmalement) et quelque seconde apres le programme de restauration c'est ouvert et a trvaillé. et pas de nouvelle de combofix.
-
ModérateurTu as fait quoi pour l'instant ?
- 1
- 2
Suivant
