[résolu] Faux antivirus et fenêtres qui s'ouvrent toutes seules

[microgolgi]

apres avoir cliqué sur le feu vert, je clique sur ok et j'ai ce message : the procedure * could not be located in the DLL urlmon.dll et le programme se ferme.

[bruce lee]

Re,

 

Avant de lancer The Avenger il faut que toutes les autres fenêtres soient fermés et que tu sois déconnecté du net.

 

@+

[microgolgi]

re.

oui c'est bien ce que j'ai fais.

[bruce lee]

Re,

 

J'ai édité ce post: http://forum.zebulon.fr/index.php?s=&s...t&p=1082836 Merci d'appliquer les nouvelles instructions.

 

@+

[microgolgi]

Re,

voila

 

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 10:30:37 26/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\awvtt.dll

C:\WINDOWS\system32\ttvwa.bak1

C:\WINDOWS\system32\ttvwa.bak2

C:\WINDOWS\system32\ttvwa.ini

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\awvtt.dll

C:\WINDOWS\system32\awvtt.dll Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\ttvwa.bak1

C:\WINDOWS\system32\ttvwa.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\ttvwa.bak2

C:\WINDOWS\system32\ttvwa.bak2 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\ttvwa.ini

C:\WINDOWS\system32\ttvwa.ini Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:23:02 26/08/2007

 

Listing files found while scanning....

 

C:\windows\system32\ftinspxg.exe

C:\windows\system32\maxjdmjb.dll

C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\pmnlm.dll

 

Beginning removal...

 

Attempting to delete C:\windows\system32\ftinspxg.exe

C:\windows\system32\ftinspxg.exe Has been deleted!

 

Attempting to delete C:\windows\system32\maxjdmjb.dll

C:\windows\system32\maxjdmjb.dll Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.bak2 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\mlnmp.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\pmnlm.dll

C:\WINDOWS\system32\pmnlm.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 17:37:16 26/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\cfhkj.bak1

C:\WINDOWS\system32\cfhkj.ini

C:\WINDOWS\system32\jkhfc.dll

C:\windows\system32\mgcenlry.exe

C:\windows\system32\ustvytly.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\cfhkj.bak1

C:\WINDOWS\system32\cfhkj.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\cfhkj.ini

C:\WINDOWS\system32\cfhkj.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\jkhfc.dll

C:\WINDOWS\system32\jkhfc.dll Could not be deleted.

 

Attempting to delete C:\windows\system32\mgcenlry.exe

C:\windows\system32\mgcenlry.exe Has been deleted!

 

Attempting to delete C:\windows\system32\ustvytly.dll

C:\windows\system32\ustvytly.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\jkhfc.dll

C:\WINDOWS\system32\jkhfc.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 18:51:55 26/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\kjllm.bak1

C:\WINDOWS\system32\kjllm.ini

C:\WINDOWS\system32\mlljk.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\kjllm.bak1

C:\WINDOWS\system32\kjllm.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\kjllm.ini

C:\WINDOWS\system32\kjllm.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlljk.dll

C:\WINDOWS\system32\mlljk.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:32:44 30/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\jkkll.dll

C:\WINDOWS\system32\llkkj.bak1

C:\WINDOWS\system32\llkkj.bak2

C:\WINDOWS\system32\llkkj.ini

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\jkkll.dll

C:\WINDOWS\system32\jkkll.dll Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\llkkj.bak1

C:\WINDOWS\system32\llkkj.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\llkkj.bak2

C:\WINDOWS\system32\llkkj.bak2 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\llkkj.ini

C:\WINDOWS\system32\llkkj.ini Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:43:12 30/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\rrutv.bak1

C:\WINDOWS\system32\rrutv.ini

C:\WINDOWS\system32\vturr.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\rrutv.bak1

C:\WINDOWS\system32\rrutv.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\rrutv.ini

C:\WINDOWS\system32\rrutv.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\vturr.dll

C:\WINDOWS\system32\vturr.dll Could not be deleted.

 

Performing Repairs to the registry.

Done!

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\vturr.dll

C:\WINDOWS\system32\vturr.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:50:50 30/08/2007

 

Listing files found while scanning....

 

No infected files were found.

 

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:58:44 30/08/2007

 

Listing files found while scanning....

 

No infected files were found.

 

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 18:54:42 30/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\prutv.bak1

C:\WINDOWS\system32\prutv.ini

C:\WINDOWS\system32\vturp.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\prutv.bak1

C:\WINDOWS\system32\prutv.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\prutv.ini

C:\WINDOWS\system32\prutv.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\vturp.dll

C:\WINDOWS\system32\vturp.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 20:14:37 30/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\ututv.bak1

C:\WINDOWS\system32\ututv.ini

C:\WINDOWS\system32\vtutu.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\ututv.bak1

C:\WINDOWS\system32\ututv.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\ututv.ini

C:\WINDOWS\system32\ututv.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\vtutu.dll

C:\WINDOWS\system32\vtutu.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\nnnkhfe.dll

C:\WINDOWS\system32\nnnkhfe.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

[bruce lee]

Re,

 

Le fichier a l'air supprimé. Redémarre ton PC puis fait un clique droit sur Hijackthis.exe. Dans le menu déroulant, choisis "Renommer" et appele le "microgolgi".

 

Poste un nouveau rapport HijackThis.

[microgolgi]

Re,

Analyse faite hors ligne, ttes fenetres fermées.

Par contre dès que je lance l'ordi ou que je lance firefox, g des alerte intrusion de code par SPF.

 

 

Logfile of HijackThis v1.99.1

Scan saved at 14:21:41, on 31/08/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE

C:\Program Files\microgolgi\microgolgi.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.chemtable.com/order3.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {2E0290E5-1B58-40B5-9093-4EBD0FB5CB3A} - C:\WINDOWS\system32\vtutu.dll (file missing)

O2 - BHO: (no name) - {38916424-DD75-4DDB-8335-79DF03A5E9C3} - C:\WINDOWS\system32\vturp.dll (file missing)

O2 - BHO: (no name) - {4E8849C1-F7A9-4E3E-A522-178A659939A9} - C:\WINDOWS\system32\gebca.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {60D13203-2DC3-4E31-8909-E70BEC38D9F8} - C:\WINDOWS\system32\nnnkhfe.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: offline-8876480 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: gebca - C:\WINDOWS\system32\gebca.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\yeyustni.exe (file missing)

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

[bruce lee]

Re,

 

Tu t'en es rechopé un autre....

 

Relance une nouvelle fois VundoFix puis poste le rapport.

[microgolgi]

Re,

Tu t'en es rechopé un autre....

 

Relance une nouvelle fois VundoFix puis poste le rapport.

 

Hein mais comment c'est possible? j'ai rien télécharger!! cette saloperie!

enfin voila la rapport vundo :

Scan started at 14:38:29 31/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\acbeg.bak1

C:\WINDOWS\system32\acbeg.bak2

C:\WINDOWS\system32\acbeg.ini

C:\WINDOWS\system32\gebca.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\acbeg.bak1

C:\WINDOWS\system32\acbeg.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\acbeg.bak2

C:\WINDOWS\system32\acbeg.bak2 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\acbeg.ini

C:\WINDOWS\system32\acbeg.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\gebca.dll

C:\WINDOWS\system32\gebca.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

Merci encore une fois de ton aide.

[bruce lee]

Re,

 

Bien, vundofix l'a eu

 

Redémarre ton PC puis poste moi un nouveau rapport HijackThis s'il te plait.