infecte par smitfraud-C, comment s'en debarasser ?

Bonjour,

Mon ordi viens d'etre infesté par smitfraud, je ne sais pas comment m'en debarrasser, quelqu'un peut il m'aider ?
merci d'avance

salut

Télécharger sur le Bureau.
VundoFix

= Double-clic VundoFix.exe.
= Clic OK
=Attendre le redemarrage de Vundofix
=Clic Scan for Vundo
= le scan est assez long , à la fin
=Clic Remove Vundo
= Puis yes
= Le Bureau disparaît un moment lors de la suppression des fichiers.
=Message shutdown
=clic OK
=Redémarrage auto
=copier le rapport qui est dans C:\vundofix.txt


Télécharger sur le bureau
VirtumondoBegone

=Double clic sur VirtumundoBeGone.exe
=clic Continue ==> clic Start
=clic Oui
=A la fin si Vundo est présent , le PC s’éteint et redémarre

Si Ecran bleu et message : Erreur fatale .. pas de problème

=Poster le rapport VBG.TXT qui est sur le bureau

[07/15/2007, 2:30:27] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\ZISTLM5F\VirtumundoBeGone[1].exe" )
[07/15/2007, 2:30:34] - Detected System Information:
[07/15/2007, 2:30:34] - Windows Version: 5.1.2600, Service Pack 1
[07/15/2007, 2:30:35] - Current Username: Administrateur (Admin)
[07/15/2007, 2:30:35] - Windows is in NORMAL mode.
[07/15/2007, 2:30:35] - Searching for Browser Helper Objects:
[07/15/2007, 2:30:35] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[07/15/2007, 2:30:35] - BHO 2: {36DBC179-A19F-48F2-B16A-6A3E19B42A87} ()
[07/15/2007, 2:30:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/15/2007, 2:30:35] - Checking for HKLM\...\Winlogon\Notify\diantz
[07/15/2007, 2:30:35] - Key not found: HKLM\...\Winlogon\Notify\diantz, continuing.
[07/15/2007, 2:30:35] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/15/2007, 2:30:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/15/2007, 2:30:35] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/15/2007, 2:30:35] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/15/2007, 2:30:35] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[07/15/2007, 2:30:35] - BHO 5: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[07/15/2007, 2:30:35] - Finished Searching Browser Helper Objects
[07/15/2007, 2:30:35] - Finishing up...
[07/15/2007, 2:30:35] - Nothing found! Exiting...

[07/15/2007, 2:31:30] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\ZISTLM5F\VirtumundoBeGone[1].exe" )
[07/15/2007, 2:31:34] - Detected System Information:
[07/15/2007, 2:31:34] - Windows Version: 5.1.2600, Service Pack 1
[07/15/2007, 2:31:34] - Current Username: Administrateur (Admin)
[07/15/2007, 2:31:34] - Windows is in NORMAL mode.
[07/15/2007, 2:31:34] - Searching for Browser Helper Objects:
[07/15/2007, 2:31:34] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[07/15/2007, 2:31:34] - BHO 2: {36DBC179-A19F-48F2-B16A-6A3E19B42A87} ()
[07/15/2007, 2:31:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/15/2007, 2:31:34] - Checking for HKLM\...\Winlogon\Notify\diantz
[07/15/2007, 2:31:34] - Key not found: HKLM\...\Winlogon\Notify\diantz, continuing.
[07/15/2007, 2:31:34] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/15/2007, 2:31:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/15/2007, 2:31:34] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/15/2007, 2:31:34] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/15/2007, 2:31:34] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[07/15/2007, 2:31:34] - BHO 5: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[07/15/2007, 2:31:34] - Finished Searching Browser Helper Objects
[07/15/2007, 2:31:35] - Finishing up...
[07/15/2007, 2:31:35] - Nothing found! Exiting...

et vundo fix ?

Bonjour j'ai le même problème, je suis infecté par smitfraud-C... Voici mon rapport VundoFix :

VundoFix V6.5.4

Checking Java version...

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 15:43:57 15/07/2007

Listing files found while scanning....

C:\windows\system32\ejfrcyoq.dll
C:\WINDOWS\system32\gebyv.dll
C:\windows\system32\haodjrbt.dll
C:\windows\system32\oppyjfcv.ini
C:\windows\system32\qoycrfje.ini
C:\windows\system32\tbrjdoah.ini
C:\WINDOWS\system32\vcfjyppo.dll
C:\WINDOWS\system32\vybeg.bak1
C:\WINDOWS\system32\vybeg.bak2
C:\WINDOWS\system32\vybeg.ini
C:\WINDOWS\system32\vybeg.ini2
C:\WINDOWS\system32\vybeg.tmp

Beginning removal...

Attempting to delete C:\windows\system32\ejfrcyoq.dll
C:\windows\system32\ejfrcyoq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebyv.dll
C:\WINDOWS\system32\gebyv.dll Could not be deleted.

Attempting to delete C:\windows\system32\haodjrbt.dll
C:\windows\system32\haodjrbt.dll Has been deleted!

Attempting to delete C:\windows\system32\oppyjfcv.ini
C:\windows\system32\oppyjfcv.ini Has been deleted!

Attempting to delete C:\windows\system32\qoycrfje.ini
C:\windows\system32\qoycrfje.ini Has been deleted!

Attempting to delete C:\windows\system32\tbrjdoah.ini
C:\windows\system32\tbrjdoah.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\vcfjyppo.dll
C:\WINDOWS\system32\vcfjyppo.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vybeg.bak1
C:\WINDOWS\system32\vybeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\vybeg.bak2
C:\WINDOWS\system32\vybeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\vybeg.ini
C:\WINDOWS\system32\vybeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\vybeg.ini2
C:\WINDOWS\system32\vybeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\vybeg.tmp
C:\WINDOWS\system32\vybeg.tmp Has been deleted!

Performing Repairs to the registry.
Done!

Si vous pouvez medire quoi faire, ça serait vraiment cool

as tu encore des soucis ?

Ben visiblement non, je n'ai plus de fenêtre publicitaire internet intempestive... En tout cas merci, je voulais juste être sûr d'avoir bien tout fait correctement !

Une dernière chose quand même : est-ce normal que
"Attempting to delete C:\WINDOWS\system32\gebyv.dll
C:\WINDOWS\system32\gebyv.dll Could not be deleted. " ?

supprime ce fichier dans le system32

gebyv.dll

Euh...insupprimable en mode normal, je V essayer en mode sans échec...

ok