Fenêtre intempestives

Bonjour,

J'ai des fenêtres intempestives qui s'ouvrent toutes seules sur mozilla(sans rien dedans) et sur IE (avec des pubs).

Est-ce un spam ou un virus ?

j'ai passé Malwarebyte qui a nettoyé. Je poste le rapport.
J'ai ensuite refait un scan avec Antivir mais il trouve toujours des anomalies. Est-ce normal ?
Je poste aussi le rapport.

Est-ce que Malwarebytes suffit pour enlever ses fenêtres ou y at'il autre chose à faire ?

Merci de votre aide.


Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1675
Windows 5.1.2600 Service Pack 2

22/01/2009 09:51:37
mbam-log-2009-01-22 (09-51-26).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 109914
Temps écoulé: 21 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 25
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 16

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\pxjsjtbe.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\fcccdBRK.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\yjxsfobe.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ofpfdj.dll (Trojan.Vundo) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82904c57-38c7-4e55-b67a-2c5289160875} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{82904c57-38c7-4e55-b67a-2c5289160875} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1cdde1a-2830-4851-b671-3f267f74ff4c} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a1cdde1a-2830-4851-b671-3f267f74ff4c} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a1cdde1a-2830-4851-b671-3f267f74ff4c} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{82904c57-38c7-4e55-b67a-2c5289160875} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Carlson (Dialer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\320d18a1 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\fcccdbrk -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\fcccdbrk -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Fichiers communs\Carlson (Dialer) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\system32\ofpfdj.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\fcccdBRK.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\KRBdcccf.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\KRBdcccf.ini2 (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\pxjsjtbe.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\ebtjsjxp.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\yjxsfobe.dll (Trojan.Vundo) -> No action taken.
C:\ARK6.tmp (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\axntbhmi.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\13\Local Settings\Temporary Internet Files\Content.IE5\ZSOZSG2F\kbp41256[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\13\Local Settings\Temporary Internet Files\Content.IE5\2LIG6RG8\index[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\13\Local Settings\Temporary Internet Files\Content.IE5\2LIG6RG8\upd105320[1] (Trojan.Vundo.H) -> No action taken.
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP507\A0076997.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP512\A0077363.dll (Trojan.Vundo) -> No action taken.
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\All Users\Menu Démarrer\carlton (Dialer) -> No action taken.




ET ANTIVIR




Avira AntiVir Personal
Report file date: jeudi 22 janvier 2009 09:57

Scanning for 1242124 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: LAURA

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 26/11/2008 18:34:24
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:42
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:20
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:54
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 17:38:28
ANTIVIR1.VDF : 7.1.1.113 2817536 Bytes 14/01/2009 21:03:52
ANTIVIR2.VDF : 7.1.1.148 440832 Bytes 20/01/2009 09:57:28
ANTIVIR3.VDF : 7.1.1.156 112640 Bytes 21/01/2009 09:57:30
Engineversion : 8.2.0.57
AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 18:23:42
AESCRIPT.DLL : 8.1.1.26 340347 Bytes 17/01/2009 09:09:36
AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 18:33:28
AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 18:33:36
AEPACK.DLL : 8.1.3.5 393588 Bytes 09/01/2009 21:02:00
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 11/12/2008 18:35:22
AEHEUR.DLL : 8.1.0.84 1540471 Bytes 17/01/2009 09:09:36
AEHELP.DLL : 8.1.2.0 119159 Bytes 18/11/2008 18:35:16
AEGEN.DLL : 8.1.1.10 323957 Bytes 17/01/2009 09:09:32
AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 18:23:26
AECORE.DLL : 8.1.5.2 172405 Bytes 28/11/2008 18:36:08
AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 18:23:18
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:06
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:02
AVREP.DLL : 8.0.0.2 98344 Bytes 15/09/2008 12:17:48
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:42
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:24
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:50
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:04
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:42
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:12
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:08
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:38

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: jeudi 22 janvier 2009 09:57

Starting search for hidden objects.
'50114' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'PINMENU.EXE' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned
Scan process 'MSMSGS.EXE' - '1' Module(s) have been scanned
Scan process 'MSNMSGR.EXE' - '1' Module(s) have been scanned
Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned
Scan process 'vVX1000.exe' - '1' Module(s) have been scanned
Scan process 'SweetIM.exe' - '1' Module(s) have been scanned
Scan process 'AVGNT.EXE' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'RUNDLL32.EXE' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned
Scan process 'ALG.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'MSCamS32.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'CISVC.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned
Scan process 'SCHED.EXE' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'InCDsrv.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
41 processes with 41 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '65' files ).


Starting the file scan:

Begin scan in 'C:\' <ACER>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP512\A0077150.exe
[0] Archive type: RSRC
--> Object
[1] Archive type: CAB (Microsoft)
--> Setup_00.exe
[DETECTION] Contains recognition pattern of the DR/Vundo.ggf dropper
[NOTE] The file was moved to '49a83c81.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP513\A0077388.dll
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '49a83c8d.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP513\A0077391.dll
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '49a83c91.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP513\A0077392.dll
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '49a83c95.qua'!


End of the scan: jeudi 22 janvier 2009 10:29
Used time: 32:25 Minute(s)

The scan has been done completely.

5441 Scanning directories
182013 Files were scanned
1 viruses and/or unwanted programs were found
3 Files were classified as suspicious:
0 files were deleted
0 files were repaired
4 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
182007 Files not concerned
6676 Archives were scanned
6 Warnings
4 Notes
50114 Objects were scanned with rootkit scan
0 Hidden objects were found