Un gros virus! Un! [Résolu]

slt

UN tu es optimiste :))


______________



télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

1)as tu fait un scan d antivir en mode sans echec.

regarde le tuto pour bien le configurer
http://www.malekal.com/tutorial_antivir.php



2)pour voir télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.


déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Désolé, mais je ne peux accéder a tous les sites que tu m'as envoyé. On dirait que tous les sites de protection de l'ordinateur sont bloques par le virus. Je ne peux donc pas accéder a ce site.

jlpjlp je te laisse faire .je regarde ta manip et je continue d apprendre.

Bon, j'ai réussi a avoir une "version" de MalwaresBytes

http://download4.emsisoft.com/a2AntiMalwareSetup.exe
Le lien pour votre plaisir Hehe!

Maintenant, le scan est en cour. Je vous envoie le rapport des que possible.

Bon. Voila! Une autre partie d'un plus grand probleme.

J'ai été dans cmd.exe et j'ai taper Regedit (Et oui je ne suis pas si nul en Informatique :O)
Et puis... Pouf! Un message d'erreur apparet et me dit que l'accès a RegEdit m'a été interdit par mon Administrateur.
Or, je suis le seul Admin sur mon ordi.
Si je peux vous donner mon avis, je crois que nous avons affaire a un de ces Virus Alert! Encore une fois ...
-------------------------------------------
Il n'y a guère au monde un plus bel excès que celui de la reconnaissance.
Merci de remercier les gens pour le temps qu'ils ont investis pour régler votre problème.

Avira AntiVir Personal
Report file date: 11 janvier 2009 12:45

Scanning for 1179377 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: MICRO-ADMIN

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 2008-11-18 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 2008-11-25 22:16:11
AVSCAN.DLL : 8.1.4.0 40705 Bytes 2008-05-26 13:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 2008-06-12 18:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 2008-05-26 13:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 21:26:04
ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 2008-12-24 04:16:17
ANTIVIR2.VDF : 7.1.1.88 726528 Bytes 2009-01-08 00:10:29
ANTIVIR3.VDF : 7.1.1.96 100864 Bytes 2009-01-10 00:10:43
Engineversion : 8.2.0.54
AEVDF.DLL : 8.1.0.6 102772 Bytes 2008-10-19 00:03:09
AESCRIPT.DLL : 8.1.1.24 340348 Bytes 2009-01-10 00:10:31
AESCN.DLL : 8.1.1.5 123251 Bytes 2008-11-09 18:33:23
AERDL.DLL : 8.1.1.3 438645 Bytes 2008-11-09 18:33:22
AEPACK.DLL : 8.1.3.5 393588 Bytes 2009-01-10 00:10:29
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 2008-12-11 22:36:32
AEHEUR.DLL : 8.1.0.78 1532280 Bytes 2009-01-10 00:10:26
AEHELP.DLL : 8.1.2.0 119159 Bytes 2008-11-18 23:06:29
AEGEN.DLL : 8.1.1.8 323956 Bytes 2008-12-11 22:36:23
AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-19 00:02:47
AECORE.DLL : 8.1.5.2 172405 Bytes 2008-11-28 22:15:34
AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-19 00:02:44
AVWINLL.DLL : 1.0.0.12 15105 Bytes 2008-07-09 14:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 2008-05-16 15:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 2008-10-19 00:02:42
AVREG.DLL : 8.0.0.1 33537 Bytes 2008-05-09 17:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 2008-02-12 14:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 2008-06-12 18:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008-01-22 23:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 2008-06-12 18:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 2008-01-25 18:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 2008-06-12 19:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 2008-06-27 19:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 11 janvier 2009 12:45

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Module is infected -> 'C:\WINDOWS\system32\nvsvc32.exe'
Scan process 'csrssc.exe' - '1' Module(s) have been scanned
Module is infected -> 'C:\DOCUME~1\Micro\LOCALS~1\Temp\csrssc.exe'
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrB.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'lxdccoms.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'ehSched.exe' - '1' Module(s) have been scanned
Scan process 'ehRecvr.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'winlogin.exe' - '1' Module(s) have been scanned
Module is infected -> 'C:\WINDOWS\TEMP\winlogin.exe'
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
Process 'nvsvc32.exe' has been terminated
Process 'csrssc.exe' has been terminated
Process 'winlogin.exe' has been terminated
C:\WINDOWS\system32\nvsvc32.exe
[DETECTION] Is the TR/Dldr.Agent.aofm Trojan
[NOTE] TR/Dldr.Agent.aofm:[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NVSvc]
[NOTE] TR/Dldr.Agent.aofm:[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NVSvc]
[NOTE] The file was moved to '49dd30e6.qua'!
C:\DOCUME~1\Micro\LOCALS~1\Temp\csrssc.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49dc30e6.qua'!
C:\WINDOWS\TEMP\winlogin.exe
[DETECTION] Is the TR/PSW.LdPinch.BO.9 Trojan
[NOTE] The file was moved to '49d830de.qua'!

42 processes with 39 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '47' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\yruuem.exe
[DETECTION] Contains recognition pattern of the DR/MicroJoiner.Gen dropper
[NOTE] The file was moved to '49df30f3.qua'!
C:\Documents and Settings\Micro\Local Settings\temp\2656232324.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '499f3283.qua'!
C:\Documents and Settings\Micro\Local Settings\temp\2842951074.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '499e3287.qua'!
C:\Documents and Settings\Micro\Local Settings\temp\3262169824.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49a03283.qua'!
C:\Documents and Settings\Micro\Local Settings\temp\66297732.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '499c328a.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\0DTF1FDZ\akhhiiwjg[1].htm
[DETECTION] Is the TR/Tiny.705 Trojan
[NOTE] The file was moved to '49d232c1.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\0DTF1FDZ\slviw[2].htm
[DETECTION] Is the TR/Tiny.705 Trojan
[NOTE] The file was moved to '49e032c6.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\0DTF1FDZ\tmjww[1].htm
[DETECTION] Is the TR/PSW.LdPinch.BO.10 Trojan
[NOTE] The file was moved to '49d432c9.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\7NHZIAT1\aasuper0[2].htm
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49dd32c0.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\7NHZIAT1\aasuper1[1].htm
[DETECTION] Contains recognition pattern of the DR/MicroJoiner.Gen dropper
[NOTE] The file was moved to '49dd32c2.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\7NHZIAT1\ihuirffggg[1].htm
[DETECTION] Is the TR/Tiny.705 Trojan
[NOTE] The file was moved to '49df32cb.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\9GH0Y1BM\cd[1].htm
[0] Archive type: HIDDEN
--> FIL\\\?\C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\9GH0Y1BM\cd[1].htm
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49c532cd.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\9GH0Y1BM\dakkkylzmn[1].htm
[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)
[NOTE] The file was moved to '49d532d0.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\VVMDOEXA\cd[1].htm
[0] Archive type: HIDDEN
--> FIL\\\?\C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\VVMDOEXA\cd[1].htm
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49c532d6.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\VVMDOEXA\clijjkxxuv[1].txt
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE] The file was moved to '49d332de.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\VVMDOEXA\coke[1]
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49d532e1.qua'!
C:\Documents and Settings\Micro\Local Settings\Temporary Internet Files\Content.IE5\VVMDOEXA\rollm[1].htm
[DETECTION] Is the TR/Tiny.705 Trojan
[NOTE] The file was moved to '49d632e3.qua'!
C:\WINDOWS\system32\rwhbfb873unjdfdg.dll
[DETECTION] Is the TR/PSW.LdPinch.BO.6 Trojan
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26003
[WARNING] The file could not be deleted!
[NOTE] Attempting to perform action using the ARK lib.
[NOTE] The file was moved to '49d24b09.qua'!
C:\WINDOWS\system32\drivers\66a0dec5.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\8ea1409f.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\Temp\14.tmp
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49984be2.qua'!
C:\WINDOWS\Temp\17.tmp
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49984be5.qua'!
C:\WINDOWS\Temp\1F.tmp
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49984bf4.qua'!
C:\WINDOWS\Temp\45.exe0.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49984be3.qua'!
C:\WINDOWS\Temp\software.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49d04c1d.qua'!


End of the scan: 11 janvier 2009 14:43
Used time: 1:57:48 Hour(s)

The scan has been done completely.

4906 Scanning directories
341080 Files were scanned
28 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
0 files were deleted
0 files were repaired
26 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
341047 Files not concerned
2083 Archives were scanned
5 Warnings
26 Notes

Voila le raport D'antivir en attendant celui de Malwares

1)as tu regarder cela?

"regarde le tuto pour bien le configurer
http://www.malekal.com/tutorial_antivir.php " voir mon 1 er message

toujours pas , cela ne sert a rien de t envoyer si tu ne les applique pas lorsque tu fais apres ton scan.pas de recherche de rootkit par exemple.
fait ce qui est indique et refais un scan apres avoir suivi les indications.

2)apres avoir effectuer cela peux tu telecharger combofix?je te conseille si tu as pu le telecharger de le renommer avant de lancer un scan au cas ou.

télécharge combofix renommé en killfix ici et colle le rapport (désactive antivir le temps de le télécharger et de le lancer)




http://sd-1.archive-host.com/membres/up/193094576412487685/Killfix.exe

Merci, mais j'ai regler mon probleme :)

peux tu me dire comment comme cela j apprend plus et mieux si tu as des rapports passe les moi. je te remercie.


as tu aussi revu tes defences car par exemple pas de vrai pare feu et surement d autres petites choses.

J'ai Antivir et Spybot donc je suis proteger de n'importe quelle modification registre, ce qui m'empeche donc d'avoir affaire a un "Vrai" virus sans que je ne m'en rendre compte. Pour les rapports, j'en ai aucun, mais je peux tout de meme te donner les chemins "d'installation" des virus.
C:\Windows\System 32\Drivers\Tdssypaera (Et pourquoi pas hein? Un beau dossier systeme qui est cache)
C:\Windows\System 32\TDSSmchp.dll
C:\Windows\System 32\TDSSangvy.dat
C:\Windows\System 32\TDSSdent.dll
C:\Windows\System 32\TDSSvxrr.dll
C:\Windows\System 32\TDSSvoce.dll
C:\Windows\System 32\TDSSnmxh.dll
C:\Windows\System 32\TDSSewhup.dll
C:\Windows\System 32\TDSSggrc.log
Quelle Originalite pour les noms O.o. Le TDSS est suspect quoi qu'il peut tout de meme passer pour quelque chose d'important vu le nombre de ceux-ci dans un aussi grand dossier que System 32.

Bonsoir

J'ai Antivir et Spybot donc je suis proteger de n'importe quelle modification registre, ce qui m'empeche donc d'avoir affaire a un "Vrai" virus sans que je ne m'en rendre compte.

C'est beau d'y croire

Serais curieux de voir un rapport Hijackthis.

oui hijack et rapport combo fix pas vu.

et apres lance toi la dedans.

*Télécharge SDFix (créé par AndyManchesta)
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
*Double-clique sur SDFix.exe
*Choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
*Redémarre en mode sans échec
*Ouvre le dossier SDFix qui vient d'être créé à la racine de ton disque dur C:\
*Double clique sur RunThis.bat pour lancer le script. (Le .bat peut ne pas apparaître)
*Appuie sur Y pour commencer le processus de nettoyage.
*Appuie sur une touche pour redémarrer quand SDFix te demander d'appuyer sur une touche pour redémarrer.
*Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
*Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
*Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
*Les icônes du Bureau affichées, le rapport SDFix s'ouvrira. Il porte le nom de Report.txt.
*Copie/colle le contenu


*Si Sdfix ne se lance pas
* Clique sur Démarrer > Exécuter
*Copie/colle ceci: %systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe
*Clique sur Ok.
*Redémarre et essaie de relance SDFix.

slt pour virer les infections
de type
Tdss...


il faudrait nous montrer le rapport combofix et sdfix!