virus TR/Spy.Bancos.abw.18Fermé

Question

Bonjour, J'ai un gros problème, j'ai été infecté par le virus TR/Spy.Bancos.abw.18 et je n'arrive pas à m'en débarrasser!! Symptomes : le fichier .exe de firefox a été supprimé (en réinstallant firefox je réussi à m'en resservir) internet explorer se lance régulièrement sans que je ne lui demande rien, il m'envoie sur la page moneyisunlimited.com qui est une copie de la page d'accueil de google impossible d'aller dans le gestionnaire des tâches, en faisant Alt+Ctrl+Suppr j'ai le message suivant : "Le Gestionnaire des tâches a été désactivé par votre administrateur" je n'ai plus d'invite de commande impossible de changer le mode d'affichage des dossiers et fichier dans windows (pour afficher les dossiers et fichiers cachés par exemple), quand je vais dans un dossier de mon disque dur, le menu déroulant outil est : Connecter un lecteur réseau/Déconnecter un lecteur réseau/synchroniser impossible d'aller dans l'outil de restauration du système J'ai lancé ATF Cleaner, Exido et antivir en mode sans echec, le virus est bien détecté et supprimé mais je n'ai jamais pu retrouver le gestionnaire des tâches et il revient toujours. De plus en laçant plusieurs scan d'antivir, j'ai remarqué qu'il y a plus de viru détecté à chaque fois : j'en avais 6 au début, et maintenant 14!! Voila je ne sais vraiment plus quoi faire, j'ai l'impression de n'avoir aucun moyen d'action!!! Si quelqu'un peut m'aider ou a une idée ce serait vraiment sympa, je vous poste le rapport d'antivir que j'ai lancé ce matin : AntiVir PersonalEdition Classic Report file date: jeudi 27 septembre 2007 07:12 Scanning for 855675 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: PC-FOUZI Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15 ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:26:55 ANTIVIR2.VDF : 7.0.0.4 174592 Bytes 24/09/2007 20:51:48 ANTIVIR3.VDF : 7.0.0.21 113664 Bytes 26/09/2007 20:51:48 AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 16:43:56 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00 AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: E:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: jeudi 27 septembre 2007 07:12 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'X10nets.exe' - '1' Module(s) have been scanned Scan process 'reader_sl.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'SuperCopier.exe' - '1' Module(s) have been scanned Scan process 'msmsgs.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'mmtask.exe' - '1' Module(s) have been scanned Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned Scan process 'PCMService.exe' - '1' Module(s) have been scanned Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned Scan process 'WButton.exe' - '1' Module(s) have been scanned Scan process 'OSD.exe' - '1' Module(s) have been scanned Scan process 'HotkeyApp.exe' - '1' Module(s) have been scanned Scan process 'LaunchAp.exe' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'sqlservr.exe' - '1' Module(s) have been scanned Scan process 'mdm.exe' - '1' Module(s) have been scanned Scan process 'LogWatNT.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned Scan process 'guard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 43 processes with 43 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Boot sector 'E:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '34' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP337\A0047270.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP338\A0047402.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP338\A0047403.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP338\A0047404.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP338\A0047407.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP348\A0052755.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP348\A0052756.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP348\A0052757.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP348\A0052766.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP348\A0052767.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'D:\' D:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP337\A0047295.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! D:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP338\A0047790.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! D:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP346\A0052396.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! D:\System Volume Information\_restore{D5A39691-C46A-4320-AADD-AD834906DBEB}\RP348\A0052760.exe [DETECTION] Is the Trojan horse TR/Spy.Bancos.abw.18 [INFO] The file was deleted! Begin scan in 'E:\' End of the scan: jeudi 27 septembre 2007 09:39 Used time: 2:26:52 min The scan has been done completely. 9734 Scanning directories 370633 Files were scanned 14 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 14 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 3 Files cannot be scanned 370619 Files not concerned 7847 Archives were scanned 3 Warnings 2 Notes Merci pour votre aide!

clownface · Answer

bonsoir,

fais un scan hijackthis, on va commencer par te rendre tes droits d'admin..

Virus TR/Spy.Bancos.abw.18

1 réponse

Discussions similaires

Newsletters