Help! infesté par 2 virus

Bonjour tout le monde

Je suis infesté depuis quelques jours par 2 virus : TROJ VUNDO.BE et TROJ AGENT.DJD (scan fait par secuser.com).
Malheuresement, je ne peux pas les supprimer. Si quelqu'un pouvait m'aider.

Merci d'avance

Répondre

Inscrivez-vous ou connectez-vous pour masquer ceci.

8redemarre ton PC, appuis sur F8 et demarre en mode sans echec.
Tente un suppression avec ton antivirus ou manuellement.

Regarde sur internet en indiquant le nom du virus sur google, il te sera précisé comment faire

Répondre à fnec

j ai deja tenté de les virer en mode sans échec, et c'est pas possible. Et sur google j'ai trouvé 2 3 truc qui explique pour l'un des virus mais pas pour l'autre. Donc du coups je m'en remets aux pro de l'informatique qui naviguent ici. ;-)

Pour plus de précision, voici un log fait par hijackthis

Citation :

Logfile of HijackThis v1.99.1
Scan saved at 11:11:39, on 08/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\{DCEDC832-0898-1036-1022-030114040021}\Update.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ASKS~1\scanregw.exe
C:\Program Files\??crosoft\?hkntfs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TClock\TClock.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\TEMP\idd1D42.tmp.exe
C:\WINDOWS\TEMP\win18E1.tmp.exe
C:\Documents and Settings\hadess\Bureau\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {9233934D-268D-535E-DFF9-5417B68055BB} - C:\WINDOWS\system32\jktqf.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [Tbes] "C:\WINDOWS\system32\ASKS~1\scanregw.exe" -vt yax
O4 - HKCU\..\Run: [Vspk] C:\Program Files\??crosoft\?hkntfs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 9676568939
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/Yaz [...] refid=1123
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{005B7163-C5FF-4FEA-BD9B-8A185C61D33B}: NameServer = 212.27.54.252,212.27.53.252
O17 - HKLM\System\CS1\Services\Tcpip\..\{005B7163-C5FF-4FEA-BD9B-8A185C61D33B}: NameServer = 212.27.54.252,212.27.53.252
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowexec.dll C:\WINDOWS\system32\nslookup.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Répondre à flowerpowerr

Bonjour,

Plusieurs infections !!

1/ Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

Double-clique VundoFix.exe afin de le lancer.
Coche Run VundoFix as a task.
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok
Clique sur le bouton Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown" ); clique OK
Démarre ton PC à nouveau.
Copie/colle le contenu du rapport situé dans C:\vundofix.txt dans ta prochaine réponse.

2/ Télécharge la version d'évaluation d'Ewido:
http://www.ewido.net/en/download/
Installe le sur ton bureau

Démarre Ewido avec l'icône qui se trouve sur ton Bureau.
Clique sur Update Now,
attend la fin de cette mise à jour,
puis ferme le programme.

Redémarre en mode Sans Échec
(au démarrage, tapote immédiatement la touche F8), puis tu verras un écran avec choix de démarrages :
choisis Mode sans échecavec les flèches du clavier, puis valide avec Entrée.
Choisis ton compte usuel (et non Administrateur).

Relance Ewido et clique sur Scanner
Puis sur l'onglets Settings, pour How to Act sélèctionne Quarantine.

Reviens a l'onglet Scan cliques Complete system Scan.
Le scan démarre.

A la fin cliquer sur Apply all actions
Puis sur Save report et pour finir Save report asposte le rapport dans ta réponse et poste un rapport HijackThis[/b].

Répondre à bob_

Voici déjà le log de VundoFix. Je suis entraint de faire le reste. J'éditerai juste apres.

Citation :

VundoFix V5.1.5

Checking Java version...

Java version is 1.5.0.6

Scan started at 12:50:09 08/08/2006

Listing files found while scanning....

C:\windows\system32\mllmm.dll
C:\windows\system32\mmllm.ini
C:\windows\system32\mmllm.bak2
C:\windows\system32\mmllm.tmp

Beginning removal...

The process smss.exe was successfully stopped

The process winlogon.exe could not be stopped
Vundofix may not be able to delete some files that were found.

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete C:\windows\system32\mllmm.dll
C:\windows\system32\mllmm.dll Could not be deleted.

Attempting to delete C:\windows\system32\mmllm.ini
C:\windows\system32\mmllm.ini Has been deleted!

Attempting to delete C:\windows\system32\mmllm.bak2
C:\windows\system32\mmllm.bak2 Has been deleted!

Répondre à flowerpowerr

voici le scan d'ewido

Citation :

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 14:20:23 08/08/2006

+ Scan result:

C:\Program Files\Safety Bar -> Adware.Generic : Cleaned with backup (quarantined).
C:\Program Files\Safety Bar\Safety Bar.dll -> Adware.Generic : Cleaned with backup (quarantined).
C:\Program Files\Safety Bar\Uninstall.bat -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{052b12f7-86fa-4921-8482-26c42316b522} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{052b12f7-86fa-4921-8482-26c42316b522} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Safety Bar -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-1644491937-1275210071-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{052B12F7-86FA-4921-8482-26C42316B522} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-1644491937-1275210071-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{873EB32D-AE1A-4183-89BD-45A77F761BE4} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Program Files\Cowabanga\Cowabanga.exe -> Adware.MediaTicket : Cleaned with backup (quarantined).
C:\WINDOWS\YAXUninst.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\Program Files\Міcrosoft\сhkntfs.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\__delete_on_reboot__n_s_l_o_o_k_u_p_._d_l_l_ -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\__delete_on_reboot__w_o_w_e_x_e_c_._d_l_l_ -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jktqf.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Clickspring -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\VundoFix Backups\mllmm.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mllmm.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
HKU\S-1-5-21-1644491937-1275210071-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd18E2.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd18E6.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd18EE.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd18F4.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd190A.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1924.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd194A.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1969.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1989.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd19AE.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd19C8.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd19FC.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A18.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A28.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A34.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A5C.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A64.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A65.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A66.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A67.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A76.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A7E.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1A97.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1AC6.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1ADD.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1AF2.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1B09.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1B35.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1BA0.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1BBA.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1BEB.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1BFF.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1C15.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1C3E.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1C50.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1C5C.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1C7B.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1C90.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1CB9.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1CCE.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1CE3.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1CF8.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1CFF.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1D19.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1D34.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1D42.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1D68.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1D78.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1D79.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1D7A.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd22.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\system32\Тasks\scanregw.exe -> Downloader.PurityScan.cu : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win50F.tmp.exe -> Downloader.Small.cvw : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Local Settings\Temporary Internet Files\Content.IE5\6ICVZTYO\l11[1].exe -> Downloader.Zlob.acv : Cleaned with backup (quarantined).
:mozilla.81:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.82:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.267:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.268:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.100:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.98:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.99:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.71:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
:mozilla.76:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup (quarantined).
:mozilla.40:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.91:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).
:mozilla.234:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.235:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.11:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.17:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.18:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.8:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.9:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.186:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
:mozilla.261:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
:mozilla.77:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
:mozilla.83:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
:mozilla.158:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.159:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.160:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.162:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.22:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
:mozilla.174:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
:mozilla.175:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
:mozilla.199:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.200:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.201:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.202:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.203:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.51:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.52:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.53:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.237:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.239:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.121:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.123:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.124:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.125:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.39:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined).
:mozilla.44:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined).
:mozilla.219:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
:mozilla.220:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
:mozilla.221:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Cookies\hadess@weborama[2].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
:mozilla.155:C:\Documents and Settings\hadess\Application Data\Mozilla\Firefox\Profiles\ehv7id4q.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\WINDOWS\system32\bhiwiugq.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\bjlxsbca.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\cnqxwjcm.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\cuxtylwx.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dfhwvray.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dovlbumc.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dyemkiad.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\fqiobnds.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\fxgqkbyp.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\fxwxwdmi.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\gmeemrpj.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\kuvefgsk.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\ohvihdti.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pfqxxtyg.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pgnymwga.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pkefxnsm.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\qsmvdlkj.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\rnqnyujr.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\thrhtgwm.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\uhqxlwlm.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vdymoshi.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vvuhcsma.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\wqeskxfy.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\wxbghpjm.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\system32\yugewcfy.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Local Settings\Temporary Internet Files\Content.IE5\UKBJ6GBY\srvqwe[1].exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win18DA.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win191E.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win1D40.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\Documents and Settings\hadess\Local Settings\Temp\NI.UWA6PV_0001_N86M0507\setup.exe -> Trojan.Fakealert : Cleaned with backup (quarantined).

::Report end

et voici le scan d'hijackthis

Citation :

Logfile of HijackThis v1.99.1
Scan saved at 14:24:04, on 08/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\TClock\TClock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\hadess\Bureau\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {9233934D-268D-535E-DFF9-5417B68055BB} - C:\WINDOWS\system32\jktqf.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [Vspk] C:\Program Files\??crosoft\?hkntfs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 9676568939
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/Yaz [...] refid=1123
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{005B7163-C5FF-4FEA-BD9B-8A185C61D33B}: NameServer = 212.27.54.252,212.27.53.252
O17 - HKLM\System\CS1\Services\Tcpip\..\{005B7163-C5FF-4FEA-BD9B-8A185C61D33B}: NameServer = 212.27.54.252,212.27.53.252
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowexec.dll C:\WINDOWS\system32\nslookup.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

PS: je viens de rescan avec secuser.com et il redétecte les deux virus

PS': C bon finalement je visn de supprimer manuellement le fichier où il y avait le virus TROJ VUNDO.BE.
Mais secuser detecte toujours TROJ AGENT.DJD

Répondre à flowerpowerr

Je prépare un modèle de desinfection
Réponse dans 15 min

Répondre à bob_

Re,

La procédure est longue et en partie en mode sans échec. Attention, tu n'as pas accès à Internet dans ce mode, enregistre cette page Web (clique sur fichier/enregistrer sous/choisis « Bureau ») ou imprime ce que tu as à faire.

1/Télécharge le FixWareout d'un de ces deux sites sur le bureau:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

Quand ton système aura redémarré, suis les invites des messages.

A la fin du fix, tu auras peut-être encore besoin de redémarrer le PC.

Au final, poste le contenu de C:\fixwareout\report.txt

2/ Télécharge ces utilitaires mais ne fait les utilises pas pour l’instant :

- Ccleaner
http://www.filehippo.com/download_ccleaner/

Installe le dans un répertoire dédié car précédemment pour HJT (attention à l'installation pense à decocher l'installation de Yahoo toolbar).

- Remet à jour Ewido

3/ Redémarre en mode sans échec.

Redémarre l'ordinateur.
Une fois le chargement du BIOS terminé, il y a un écran noir. Tapotes sur la touche F8 (si F8 ne fonctionne pas essaie avec la touche F5) jusqu'à l'affichage du menu des options avancées de Windows.
En utilisant les touches du curseur, sélectionnes le mode sans échec approprié et appuies sur Entrée.

4/ Lance HijackThis
puis --> Do a system scan only
coche les lignes indiquées ci-dessous

R3 - URLSearchHook: (no name) - {9233934D-268D-535E-DFF9-5417B68055BB} - C:\WINDOWS\system32\jktqf.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [Vspk] C:\Program Files\??crosoft\?hkntfs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 9676568939
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/Yaz [...] refid=1123
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowexec.dll C:\WINDOWS\system32\nslookup.dll

Apres avoir coché les cases :
(ferme toutes les fenêtres sauf HJT)
Appuies --> Fix checked
puis oui à la question de confirmation

5/ Assure-toi que tu as accès aux fichiers cachés.
(Démarrer->Poste de travail->Outils->Options des dossiers...->Affichage
"Afficher les fichiers et dossiers cachés" ->clique dessus
"Masquer les extensions des fichiers dont le type est connu" ->décoché
"Masquer les fichiers protégés du système d'exploitation" ->décoché
Valide les changements.

6/ Ensuite supprime les fichiers et/ou dossiers suivants si présents :

C:\WINDOWS\system32\jktqf.dll
C:\Program Files\ToolBar888 <== le dossier
C:\Program Files\TClock <== le dossier
C:\Program Files\??crosoft <== le dossier
C:\WINDOWS\system32\nslookup.dll

7/ Lance Ccleaner puis clique sur le bouton « Analyse » ensuite bouton « Lancer le Nettoyage ». Ensuite fait de même sur le bouton « Erreurs » puis « chercher des erreurs » et « réparer les erreurs sélectionnées ».

8/ - Relance Ewido puis choisis l'onglet " Scanner "
Fais un " Complete System Scan "
** Si un fichier est infecté, choisis l'option " Apply All Actions " en fin d'analyse **
Clique sur " Save Report " puis sur " Save Report As "
Enregistre le fichier .txt généré sur ton bureau.

9/ Redémarre normalement, colles le rapport Ewido, puis un nouveau rapport Hijackthis.

10/ Fais un scan en ligne chez Kaspersky

http://webscanner.kaspersky.fr/

Aide sur le scan :

http://support.kaspersky.fr/admin/ [...] inalWS.gif

Sauvegarde puis colles le rapport en fin d'analyse.

As-tu encore des dysfonctionnements ?

Répondre à bob_

je finis de faire ce que tu m'as demandé. Par contre voici le raport de fixwareout

Citation :

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
...

Microsoft (R) Windows Script Host Version 5.6
Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names...

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32

Répondre à flowerpowerr

Re,

Poste les autres rapports ;-)

Répondre à bob_

re

j'ai pas reussi a faire ton scan sur kaspersky. Par contre, avec secuser je detecte tjrs un virus : Troj Agent.djd CWINDOWS/SYSTEM32/winzwr32.dll

J'ai un icone chelou qui s'est mis en place. Il me signale que mon system d'exploitation est victime d'une contrefacon, alors que c'est un logiciel acheté.

Et voici les different logs:

Citation :

Logfile of HijackThis v1.99.1
Scan saved at 21:38:49, on 08/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\hadess\Bureau\Hijackthis\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\4f285cbce05ba8e7f818e6e4a48a0f18\update\update.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {9233934D-268D-535E-DFF9-5417B68055BB} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O2 - BHO: (no name) - {D4A51A3B-794E-4D9C-A752-87779BC88525} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{005B7163-C5FF-4FEA-BD9B-8A185C61D33B}: NameServer = 212.27.54.252,212.27.53.252
O17 - HKLM\System\CS1\Services\Tcpip\..\{005B7163-C5FF-4FEA-BD9B-8A185C61D33B}: NameServer = 212.27.54.252,212.27.53.252
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzwr32 - C:\WINDOWS\SYSTEM32\winzwr32.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Citation :

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 21:33:55 08/08/2006

+ Scan result:

C:\VundoFix Backups\mllmm.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).

::Report end

Répondre à flowerpowerr

Bonsoir,

Télécharge : Pocket KillBox

Mets le dans un dossier ou sur ton bureau (Clique droit puis Extraire tout)
Selectionne le texte dans le cadre:

Citation :

C:\WINDOWS\SYSTEM32\winzwr32.dll

Clique droit puis Copier.
----------

. Ouvre Killbox.exe
. Choisis "Delete on reboot"
. Clique sur "File" et ensuite "Paste from Clipboard"
. " Unregistrer .dll before Deleting "
. Clique sur le rond rouge avec une croix blanche.

Une question te sera alors posée :
" File will be Removed on Reboot, Do you want to reboot now ? "

. Repond par "oui", ton pc va redemarrer.
----------

Supprime ce dossier : C:\!KillBox
----------

Répondre à Angeldark

Help! infesté par 2 virus

Forum Sécurité - Virus : Help! infesté par 2 virus

Attention