suite à une lecture (mais trop tardive) du très bon topic sécurité et prévention, je me permets de demander de l'aide car j'ai un rogue dans mon pc depuis hier soir...
Comme d'hab pour info, ma config :
CM Abit NF7S
Processeur Athlon XP 2800+
2 x 512 MO RAM G-Skill
ATI RADEON 9200 SE (j'ai honte... je vais changer promis).
Carte tuner tv Leadtek
Précision j'ai formaté mon DD il y a 1 mois ou presque...
Bon alors pour résumé, je surfais tranquilou, les mains dans les potches, quand tout d'un coup, surprise, changement de mon ecran de fond, message de virus qui m'arrive de tout côté et etc... Bizarre...
Après quelques recherches, je vois que c'est un rogue, antispywareexpert pour info, qui m'a infecté. Alors suite à quelques lectures je lance Malware bytes antimalware, dont voici le rapport ici :
Malwarebytes' Anti-Malware 1.19
Version de la base de données: 930
Windows 5.1.2600
Dossier(s) infecté(s):
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\WINDOWS\system32\qoMdAtQj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\jQtAdMoq.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jQtAdMoq.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lhjkxkcl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\lckxkjhl.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\ebaq.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\Logiciels\Photos - vidéos\ACDSee\ACDSee5\ACDSeev50WinALLKeymak.Onl\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ljJbAPhH.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\fdxbameg.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\fsrpknov.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\gpefaowr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\sqvgnrpx.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\wbxdpgfeqdb.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jerome\Bureau\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jerome\Bureau\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jerome\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jerome\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jerome\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
Confiant, je redémarre le pc...
bonne nouvelle, je n'ai plus de message fanatique d'attaques fantômes qui me conseil d'aller télécharger tel ou tel logiciel.
Mauvaise nouvelle, je n'ai plus d'écrans de fond, et impossible d'en remettre un via la commande Affichage / propriétés / bureau.
J'ai lancé une analyse complete de mon système avec Antivir (qui au passage ne l'avait pas détecté), je vous donnerais le rapport demain. Pourriez vous m'aider ??? me dire si il faut que je lance d'autres logiciels ??? (smitfraudFIX ?)
Pour info j'ai tester un scan de mon pc avec rogueremover mais il a rien trouvé. Est ce qu'un clean register pourrait arranger le tout ?
Pour info je colle mon rapport d'antivir qui a apparemment trouvé d'autres éléments...
Avira AntiVir Personal
Report file date: mardi 8 juillet 2008 00:30
Scanning for 1382539 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (plain) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: DJE-PC
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, H:, Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: mardi 8 juillet 2008 00:30
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'WTS_KEY.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'SATARaid.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'btdna.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'WFWIZ.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Kmaestro.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'sstray.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
32 processes with 32 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'H:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '28' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{16948C45-5E62-4F0F-8F67-3248B01E16CD}\RP55\A0004181.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48a300d1.qua'!
C:\System Volume Information\_restore{16948C45-5E62-4F0F-8F67-3248B01E16CD}\RP55\A0004183.exe
[DETECTION] Is the Trojan horse TR/Drop.Softomat.AN
[NOTE] The file was moved to '48a300d3.qua'!
C:\System Volume Information\_restore{16948C45-5E62-4F0F-8F67-3248B01E16CD}\RP55\A0004184.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48a300da.qua'!
C:\System Volume Information\_restore{16948C45-5E62-4F0F-8F67-3248B01E16CD}\RP55\A0004185.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
C:\WINDOWS\fdxbameg.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
C:\WINDOWS\fsrpknov.dll
[DETECTION] Is the Trojan horse TR/Drop.Softomat.AN
[NOTE] The file was deleted!
C:\WINDOWS\system32\lhjkxkcl.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
C:\WINDOWS\system32\ljJbAPhH.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
C:\WINDOWS\system32\qoMdAtQj.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
Begin scan in 'D:\'
D:\Logiciels\Photos - vidéos\CyberLink PowerDVD XP 4.0\FO-PDVD4.EXE
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\Logiciels\WinACE\WinACE_2bcalvi\W211_FR.EXE
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\System Volume Information\_restore{16948C45-5E62-4F0F-8F67-3248B01E16CD}\RP49\A0003968.exe
[DETECTION] Contains detection pattern of the dropper DR/Gator.3202.12
[NOTE] The file was deleted!
D:\System Volume Information\_restore{16948C45-5E62-4F0F-8F67-3248B01E16CD}\RP55\A0004182.EXE
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was deleted!
Begin scan in 'H:\' <Documents>
End of the scan: mardi 8 juillet 2008 08:17
Used time: 7:47:39 min
The scan has been done completely.
3972 Scanning directories
229592 Files were scanned
11 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
8 files were deleted
0 files were repaired
3 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
229581 Files not concerned
4055 Archives were scanned
4 Warnings
11 Notes
Je n'ai plus du tout de message ou d'alerte de antispywareexpert, néanmoins j'ai toujours mon écran blanc, et quelques modif dans mon menu démarrer (àmon avis je peux m attendre à d'autres choses au fur et a mesure).
>>(àmon avis je peux m attendre à d'autres choses au fur et a mesure).
Je le pense aussi, que la souche n'est pas complètement éradiquée...
Viré par MBAM...
C:\WINDOWS\system32\ljJbAPhH.dll (Trojan.Vundo) -> Delete on reboot.
Il s'est auto-recrée entre temps puisqu' antivir l'avait re-viré...
C:\WINDOWS\system32\ljJbAPhH.dll [DETECTION] Is the Trojan horse TR/Trash.Gen [NOTE] The file was deleted!
Je te laisse le lien général sur les malveillants, pour les prochaines fois. http://www.malekal.com/guide_supression_spywares.php Dans ton cas, amha c'est cette section qui devrait t'intéresser:
Virtumonde / Msevents / Trojan.vundo
ps: 2bcalvi
Dany s'est fait choper il y a 4/5 ans ?, le site avait même disparu de la Toile durant 3-6 mois ?. Puis quelq'un d'autre avait repris le flambeau, en se faisant passer pour Dany ?, mais de qualité moindre voire douteuse.
Perso je me méfierais...
Message édité par houba 78 le 09-07-2008 à 09:37:52
