TR/Vundo.Gen

Galenor · le 28 septembre 2007

I need someone help.....

Bonjour,

Voilà le souci, j'avais un ordi surinfecté...!!!!! donc lancement en mode sans échec, passage de Regseeker, CCleaner, Spybot, AVG anti spyware et Antivir.... la grosse armada en somme...

Résultat positif dans l'ensemble, mais un virus résiste et est détecté sans arrêt par Antivir au démarrage de ma bécanne essentiellement, il s'agit de Vundo.Gen, j'ai donc téléchargé VundoFix, lancé en mode sans échec, mais impossible de virer une dll en particulier ljjhebb.dll dans le system32... que ce soit en sans échec ou au redémarrage.. impossible...!!!

Je vous post mon dernier rapport de scan Antivir et un scan HijackThis.... si vous avez une solution je suis méga preneur, merci par avance pour votre aide.

AntiVir PersonalEdition Classic
Report file date: vendredi 28 septembre 2007 12:33

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name:

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15

ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:26:55

ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 13:27:04

ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 13:27:13

AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 16:43:56

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: medium

Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: vendredi 28 septembre 2007 12:33

Starting search for hidden objects.

'49202' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'VundoFix.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '0' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

19 processes with 19 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[NOTE] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Starting to scan the registry.

C:\WINDOWS\system32\ljjhebb.dll

[DETECTION] Is the Trojan horse TR/Vundo.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003

[WARNING] The file could not be deleted!

C:\WINDOWS\system32\ljjhebb.dll

[DETECTION] Is the Trojan horse TR/Vundo.Gen

The registry was scanned ( '33' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\ljjhebb.dll

[DETECTION] Is the Trojan horse TR/Vundo.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003

[WARNING] The file could not be deleted!

End of the scan: vendredi 28 septembre 2007 13:57

Used time: 1:23:50 min

The scan has been done completely.

5171 Scanning directories

210716 Files were scanned

2 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

210714 Files not concerned

10042 Archives were scanned

4 Warnings

0 Notes

49202 Objects were scanned with rootkit scan

0 Hidden objects were found

et le HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 14:23:14, on 28/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\HPQ\One-Touch\OneTouch.EXE

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hp.com/info/e-center-p

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/info/e-center-p

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5915C999-3E43-459F-AA8E-C73F08253AD0} - (no file)

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - C:\WINDOWS\system32\ljjhebb.dll

O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s

O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/0736ee81e8a3c5...RdxIE601_fr.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1167995583027

O17 - HKLM\System\CCS\Services\Tcpip\..\{2C3D87DB-E174-4E59-9477-94C59E791208}: NameServer = 55.170.5.23

O20 - Winlogon Notify: ljjhebb - C:\WINDOWS\SYSTEM32\ljjhebb.dll

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O20 - Winlogon Notify: wintlr32 - wintlr32.dll (file missing)

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - ADMtek Incorporated - (no file)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Service d'indexation (CiSvc) - Xircom, Inc. - (no file)

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Dritek System Inc. - (no file)

O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - (no file)

O23 - Service: HPWirelessMgr - Hewlett-Packard - (no file)

O23 - Service: Scannage en temps réel OfficeScanNT (ntrtscan) - Unknown owner - C:\OfficeScan NT\ntrtscan.exe

O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - (no file)

O23 - Service: Tun Inetd Service (TunNetd) - Esker - C:\Program Files\TUN\TCPW\tunnetd.exe

O23 - Service: Windows User Mode Driver Framework (UMWdf) - Esker - (no file)

O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - (no file)

J'ai juste viré les hosts

A bientôt j'espère......

Galenor · le 28 septembre 2007

Au cas ou voici le rapport Vundo.txt

VundoFix V6.5.9

Checking Java version...

Scan started at 09:12:30 28/09/2007

Listing files found while scanning....

C:\windows\system32\drvpewr.dll

C:\WINDOWS\system32\kcetvuhx.dll

C:\WINDOWS\system32\ljjhebb.dll

C:\WINDOWS\system32\sethemyw.dll

C:\WINDOWS\system32\wymehtes.ini

Beginning removal...

Attempting to delete C:\windows\system32\drvpewr.dll

C:\windows\system32\drvpewr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjhebb.dll

C:\WINDOWS\system32\ljjhebb.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\sethemyw.dll

C:\WINDOWS\system32\sethemyw.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\wymehtes.ini

C:\WINDOWS\system32\wymehtes.ini Has been deleted!

Performing Repairs to the registry.

Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ljjhebb.dll

C:\WINDOWS\system32\ljjhebb.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\sethemyw.dll

C:\WINDOWS\system32\sethemyw.dll Has been deleted!

Performing Repairs to the registry.

Done!

Beginning removal...

VundoFix V6.5.9

Checking Java version...

Scan started at 09:28:56 28/09/2007

Listing files found while scanning....

C:\windows\system32\ljjhebb.dll

Beginning removal...

Attempting to delete C:\windows\system32\ljjhebb.dll

C:\windows\system32\ljjhebb.dll Could not be deleted.

Performing Repairs to the registry.

Done!

Beginning removal...

Attempting to delete C:\windows\system32\ljjhebb.dll

C:\windows\system32\ljjhebb.dll Could not be deleted.

Performing Repairs to the registry.

Done!

VundoFix V6.5.9

Checking Java version...

Scan started at 16:03:43 28/09/2007

Listing files found while scanning....

C:\windows\system32\ljjhebb.dll

Beginning removal...

Attempting to delete C:\windows\system32\ljjhebb.dll

C:\windows\system32\ljjhebb.dll Could not be deleted.

Performing Repairs to the registry.

Done!

Beginning removal...

et le HighjackThis v2

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:20:47, on 28/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\HPQ\One-Touch\OneTouch.EXE

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Real\RealOne Player\RealPlay.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hp.com/info/e-center-p

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/info/e-center-p

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5915C999-3E43-459F-AA8E-C73F08253AD0} - (no file)

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - C:\WINDOWS\system32\ljjhebb.dll

O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s

O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/0736ee81e8a3c5...RdxIE601_fr.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1167995583027

O17 - HKLM\System\CCS\Services\Tcpip\..\{2C3D87DB-E174-4E59-9477-94C59E791208}: NameServer = 55.170.5.23

O20 - Winlogon Notify: ljjhebb - C:\WINDOWS\SYSTEM32\ljjhebb.dll

O20 - Winlogon Notify: wintlr32 - wintlr32.dll (file missing)

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - ADMtek Incorporated - (no file)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Service d'indexation (CiSvc) - Xircom, Inc. - (no file)

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Dritek System Inc. - (no file)

O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - (no file)

O23 - Service: HPWirelessMgr - Hewlett-Packard - (no file)

O23 - Service: Scannage en temps réel OfficeScanNT (ntrtscan) - Unknown owner - C:\OfficeScan NT\ntrtscan.exe

O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - (no file)

O23 - Service: Tun Inetd Service (TunNetd) - Esker - C:\Program Files\TUN\TCPW\tunnetd.exe

O23 - Service: Windows User Mode Driver Framework (UMWdf) - Esker - (no file)

O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - (no file)

--

End of file - 9749 bytes

Voila merci pour vos réponses, je reviens Lundi... bécanne du taf...!!!

Modifié le 28 septembre 2007 par Galenor

WawaSeb · le 28 septembre 2007

Bonsoir Galenor,

*** Bienvenue sur le forum sécurité de Zebulon ! ***

# Télécharge Combofix de sUBs

Ferme toutes les fenêtres
Double-clique sur combofix.exe (ne clique pas sur la fenêtre qui s'ouvre)
Appuie sur Y pour lancer le scan
A la fin du scan (cela peut prendre du temps), un rapport sera créé
Poste ce rapport dans ton / tes prochain(s) message(s)

Bon travail à toi !

Galenor · le 1 octobre 2007

Hello, de retour de WE

Alors je charge ComboFix, je le lance et voici ce que j'obtiens, c'est à dire pas grand chose

Merci pour vos réponses

angelique · le 1 octobre 2007

hello WawaSeb ;o) , Galenor

[je me permet d'intervenir WawaSeb , vu que tu n'es pas encore present,pour faire avançer le shmilblick ]

Antivir n'aime pas l'implantation de %windir%\nircmd.exe par combofix, donc desactive temporairement antivir[clic droit sur le parapluie/decoche "antivir guard enable], et renouvelle l'operation avec combofix comme preconisé par WawaSeb.

Galenor · le 1 octobre 2007

Hello Angelique,

Alors effectivement, antivir désactivé, mais malgré cela, au lancement de ComboFix, la fenêtre dos s'ouvre, message, "preparing to run ComboFix" puis fermeture de la fenêtre dos et plus rien.

.....

J-B .Z · le 1 octobre 2007

Hello Angelique,

Alors effectivement, antivir désactivé, mais malgré cela, au lancement de ComboFix, la fenêtre dos s'ouvre, message, "preparing to run ComboFix" puis fermeture de la fenêtre dos et plus rien.

.....

Telecharge Unlocker ICI et essai de le supprimer avec ça.

Ce programme supprime les fichiers ou dossier impossible a supprimer, tel qu'un fichier sois disans utilisé.

Une fois Unlocker installer, click droit sur ton fichier et unlocker

Modifié le 1 octobre 2007 par J-B .Z

Galenor · le 1 octobre 2007

Yep, unlocker téléchargé et installé, mais visiblement il y a des liens entre ce fichier ljjhebb.dll et winlogon (cf copie d'écran) et quand je tente tout débloquer, l'ordinateur plante et rédémarre

Je crains de sentir venir le Format c: !!!!!

angelique · le 1 octobre 2007

nan pas de format c:

Normallement ça devrait etre WawaSeb qui devrait t'aider!!

Utilises tu bien un compte administrateur??

*combofix est il bien sur ton bureau et pas ailleurs?

**Télécharge Look2Me-Destroyer.exe (par Atribune) sur ton Bureau.

http://www.atribune.org/content/view/28/

Ferme toutes les fenêtres actives avant de passer à l'étape suivante.

Double-clique Look2Me-Destroyer.exe afin de lancer l'outil.

Coche Run this program as a task

Un message s'affichera, te disant ceci : "Look2Me-Destroyer will close and re-open in approximately 1 minute". Clique OK

Il se relancera après la minute, puis clique sur le bouton Scan for L2M; les icônes de ton Bureau vont disparaître : c'est normal.

Lorsque le scan termine, clique sur le bouton Remove L2M

Un message Done Scanning apparaîtra, clique OK.

Un nouveau message s'affichera : Done removing infected files! Look2Me-Destroyer will now shutdown your computer; clique OK.

Ton PC va maintenant s'éteindre.

Démarre ton PC normalement.

Colle le rapport généré (Look2Me-Destroyer.txt), situé sur le Bureau

**essaie de relancer combofix

J-B .Z · le 1 octobre 2007

Pour ça perso je ne peux pas t'aider. Je laisse la place aux confirmés ! courage ! lol

Dsl angelique d'avoir voulu l'aider... bye

Modifié le 1 octobre 2007 par J-B .Z

Connexion

Pas encore inscrit ?

TR/Vundo.Gen

Messages recommandés

Galenor

Galenor

WawaSeb

Galenor

angelique

Galenor

J-B .Z

Galenor

angelique

J-B .Z

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer