Aide hijackthis Résolu

Question

Bonsoir,

J'aide quelq'un en ce moment et je voudrais savoir commment se débarasser de ça O
4 - HKLM\..\Run: [HiYo] C:\Program Files\HiYo\bin\HiYo.exe /RunFromStartup


Merci par avance.

old57 · Answer

essaie smitfraudfix
http://www.commentcamarche.net/telecharger/telecharger 230 smitfraudfix

pimprenelle27 · Answer

j'y avait pas pensé merci.

old57 · Answer

pas de quoi

pimprenelle27 · Answer

Dommage, mais il est encore là et j'ai ça en plus 
O20 - AppInit_DLLs: G G G G


voic le lien http://www.commentcamarche.net/forum/affich 10604662 virus msn envoi des message tout seul?dernier#dernier

old57 · Answer

as tu essayer combofix    http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pimprenelle27 · Answer

voici le rapport

voila le rappor combofix

tu dis de fixer les ligne avec hijack correspondante mais les quels?

ComboFix 09-01-20.05 - Mélanie 2009-01-21 18:42:16.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.3061.1436 [GMT 1:00]
Lancé depuis: c:\users\Mélanie\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-21 au 2009-01-21 ))))))))))))))))))))))))))))))))))))
.

2009-01-15 19:09 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-07 18:18 . 2009-01-07 18:18 <REP> d-------- c:\users\Mélanie\AppData\Roaming\Scatlaws
2009-01-03 12:03 . 2009-01-03 12:03 <REP> d-------- c:\windows\System32\Kaspersky Lab
2009-01-03 12:02 . 2009-01-19 21:02 <REP> d-------- c:\windows\BDOSCAN8
2008-12-29 12:00 . 2008-12-29 12:10 96,976 --a------ c:\windows\System32\drivers\klin.dat
2008-12-29 12:00 . 2008-12-29 12:10 87,855 --a------ c:\windows\System32\drivers\klick.dat
2008-12-29 11:59 . 2009-01-20 18:24 <REP> d-------- c:\users\All Users\Kaspersky Lab
2008-12-29 11:59 . 2009-01-20 18:24 <REP> d-------- c:\programdata\Kaspersky Lab
2008-12-29 11:59 . 2008-12-29 11:59 <REP> d-------- c:\program files\Kaspersky Lab
2008-12-29 11:59 . 2009-01-21 18:40 2,627,104 --ahs---- c:\windows\System32\drivers\fidbox.dat
2008-12-29 11:59 . 2009-01-21 16:29 393,248 --ahs---- c:\windows\System32\drivers\fidbox2.dat
2008-12-29 11:59 . 2009-01-21 18:40 22,624 --ahs---- c:\windows\System32\drivers\fidbox.idx
2008-12-29 11:59 . 2009-01-21 16:27 2,424 --ahs---- c:\windows\System32\drivers\fidbox2.idx
2008-12-29 11:58 . 2008-12-29 11:58 <REP> d-------- c:\users\All Users\Kaspersky Lab Setup Files
2008-12-29 11:58 . 2008-12-29 11:58 <REP> d-------- c:\programdata\Kaspersky Lab Setup Files
2008-12-26 12:19 . 2008-12-26 12:19 <REP> dr------- c:\windows\System32\config\systemprofile\Music

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-21 17:42 5,505,024 --sha-w c:\users\Mélanie\NTUSER.DAT
2009-01-21 17:42 5,505,024 --sha-w c:\users\Mélanie\NTUSER.DAT
2009-01-21 15:46 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-19 19:54 --------- d-----w c:\programdata\Spybot - Search & Destroy
2009-01-16 17:33 --------- d-----w c:\programdata\Microsoft Help
2009-01-16 17:33 --------- d-----w c:\program files\Windows Mail
2009-01-14 15:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 15:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-01-10 13:02 --------- d-----w c:\users\Mélanie\AppData\Roaming\LimeWire
2009-01-10 10:40 --------- d-----w c:\users\Mélanie\AppData\Roaming\HP
2009-01-07 18:09 --------- d-----w c:\program files\Google
2009-01-07 17:18 --------- d-----w c:\users\Mélanie\AppData\Roaming\Scatlaws
2008-12-29 10:53 --------- d-----w c:\program files\Norton Internet Security
2008-12-29 10:52 --------- d-----w c:\programdata\Norton
2008-12-29 10:52 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-15 18:02 --------- d-s---w c:\users\Mélanie\AppData\Roaming\Microsoft
2008-12-10 19:28 --------- d-----w c:\program files\PhotoFiltre
2008-12-09 19:47 --------- d-----w c:\users\Mélanie\AppData\Roaming\Adobe
2008-12-09 19:24 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-09 19:24 --------- d-----w c:\program files\Serif
2008-12-06 09:17 --------- d-----w c:\users\Mélanie\AppData\Roaming\HiYo
2008-12-06 09:17 --------- d-----w c:\programdata\HiYo
2008-12-06 09:17 --------- d-----w c:\program files\HiYo
2008-12-06 08:52 --------- d-----w c:\program files\LimeWire
2008-12-06 08:43 --------- d-----w c:\programdata\eMule
2008-12-06 08:43 --------- d-----w c:\program files\eMule
2008-12-03 16:32 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-02 18:26 --------- d-----w c:\programdata\Lavasoft
2008-12-02 18:25 --------- d-----w c:\program files\Lavasoft
2008-12-02 18:24 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-02 18:17 --------- d-----w c:\programdata\TEMP
2008-12-02 18:17 --------- d-----w c:\program files\SpywareBlaster
2008-12-02 18:06 --------- d-----w c:\users\Mélanie\AppData\Roaming\Malwarebytes
2008-12-02 18:06 --------- d-----w c:\programdata\Malwarebytes
2008-12-01 18:22 --------- d-----w c:\users\Mélanie\AppData\Roaming\TeamViewer
2008-11-30 19:32 --------- d-----w c:\programdata\Symantec
2008-11-30 19:29 --------- d-----w c:\programdata\PCSettings
2008-11-30 19:29 --------- d-----w c:\programdata\NortonInstaller
2008-11-30 19:27 --------- d-----w c:\programdata\Symantec Temporary Files
2008-11-29 14:39 --------- d-----w c:\users\Mélanie\AppData\Roaming\Creative
2008-11-28 19:05 --------- d-----w c:\programdata\WindowsSearch
2008-11-27 18:01 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-11-27 17:54 --------- d-----w c:\users\Mélanie\AppData\Roaming\Apple Computer
2008-11-27 17:54 --------- d-----w c:\programdata\Apple Computer
2008-11-27 17:54 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-27 17:54 --------- d-----w c:\program files\iTunes
2008-11-27 17:54 --------- d-----w c:\program files\iPod
2008-11-27 17:54 --------- d-----w c:\program files\Common Files\Apple
2008-11-27 17:53 --------- d-----w c:\program files\QuickTime
2008-11-27 17:53 --------- d-----w c:\program files\Bonjour
2008-11-27 17:52 --------- d-----w c:\programdata\Apple
2008-11-27 17:52 --------- d-----w c:\program files\Apple Software Update
2008-11-24 20:08 --------- d-----w c:\users\Mélanie\AppData\Roaming\Macromedia
2008-11-24 19:53 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-11-24 19:53 --------- d-----w c:\program files\Windows Live
2008-11-24 19:52 --------- d-----w c:\program files\MSXML 4.0
2008-11-24 19:51 --------- d-----w c:\programdata\WLInstaller
2008-11-24 19:50 --------- d-----w c:\program files\Microsoft Silverlight
2008-11-24 19:40 --------- d-----w c:\programdata\Dell
2008-11-24 19:32 --------- d-----w c:\programdata\HP
2008-11-24 19:27 --------- d-----w c:\program files\CCleaner
2008-11-24 19:24 --------- d-----w c:\programdata\WEBREG
2008-11-24 19:23 --------- d-----w c:\programdata\HPSSUPPLY
2008-11-24 19:23 --------- d-----w c:\program files\HP
2008-11-24 19:22 --------- d-----w c:\program files\Common Files\HP
2008-11-24 19:19 --------- d-----w c:\program files\Hewlett-Packard
2008-11-24 19:19 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2008-11-24 18:52 --------- d-----w c:\users\Mélanie\AppData\Roaming\Mozilla
2008-11-24 18:49 --------- d-----w c:\users\Mélanie\AppData\Roaming\Google
2008-11-24 18:11 --------- d-----w c:\users\Mélanie\AppData\Roaming\Symantec
2008-11-24 18:10 81,920 ----a-w c:\windows\BurnImage.exe
2008-11-24 18:10 720,896 ----a-w c:\windows\IMAPIShellExt.dll
2008-11-24 18:10 --------- d-----w c:\users\Mélanie\AppData\Roaming\Identities
2008-11-24 18:10 --------- d-----w c:\users\Mélanie\AppData\Roaming\Dell
2008-11-24 18:06 --------- d-sh--w c:\programdata\Modèles
2008-11-24 18:06 --------- d-sh--w c:\programdata\Menu Démarrer
2008-11-24 18:06 --------- d-sh--w c:\programdata\Favoris
2008-11-24 18:06 --------- d-sh--w c:\programdata\Documents
2008-11-24 18:06 --------- d-sh--w c:\programdata\Bureau
2008-11-24 18:06 --------- d-sh--w c:\programdata\Application Data
2008-11-24 18:06 --------- d-sh--w c:\program files\Fichiers communs
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini
2008-09-16 07:28 76 --sha-r c:\windows\CT4CET.bin
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-05-04 167936]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2008-03-04 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-06 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-06 133656]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-07-03 3563520]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-16 29744]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"HiYo"="c:\program files\HiYo\bin\HiYo.exe" [2008-10-23 300336]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992]

c:\users\M‚lanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-07-15 1226024]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 703280]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-09-16 50688]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-02-22 1193240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-09-16 08:51 10536 c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=G G G G

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{E6871D8B-E5E2-46DC-A12E-8E9CA227E58C}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{9B328CEC-9316-4F78-A06A-C99613F00CD1}"= c:\program files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect
"{6B5F4C97-EF94-445E-8EF5-BF403856D385}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{2FB4CB90-F5B1-49B6-80CA-C307F52FBBF4}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{CBDE61CB-5FC1-4336-9BDA-BF5CD5943132}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{F43BDC6A-60C4-4C32-AF55-625E600596D2}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{7779ECAA-9C62-4731-A539-02335CF2C49A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B1CB125E-0A97-4445-BD95-65A12C43CBE5}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9808BB9D-BD35-45D2-A195-CDCD81999DD0}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{8026AD0C-B187-4B1D-9667-DA849FA76418}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [2008-01-29 32784]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [2008-03-26 20496]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [2008-09-16 111616]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [2008-03-13 26640]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [2008-09-16 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [2008-09-16 7424]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [2008-09-16 73728]
R4 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-05-02 161048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'ℑ au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\Mélanie\AppData\Roaming\Mozilla\Firefox\Profiles\u6ugfx74.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-21 18:43:59
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\progra~1\KASPER~1\KASPER~1\adialhk.dll
c:\progra~1\KASPER~1\KASPER~1\kloehk.dll

- - - - - - - > 'lsass.exe'(768)
c:\progra~1\KASPER~1\KASPER~1\adialhk.dll
c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
.
Heure de fin: 2009-01-21 18:46:34
ComboFix-quarantined-files.txt 2009-01-21 17:46:29

Avant-CF: 237'763'530'752 octets libres
Après-CF: 237,653,438,464 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
241 --- E O F --- 2009-01-19 18:58:05

old57 · Answer

tiens essayer ca
Télécharger Chaos Shredder   http://www.commentcamarche.net/telecharger/telecharger 34055093 chaos shredder                Démo d’utilisation ici (merci à Balltrap34 pour cette réalisation) 
http://pageperso.aol.fr/balltrap34/demochaos.swf

pimprenelle27 · Answer

Merci.

pimprenelle27 · Answer

Excuse moi les liens que tu m'a donné ne fonctionne plus .

old57 · Answer

http://www.commentcamarche.net/telecharger/telecharger 34055093 chaos shredder
pris içi sur ccm

old57 · Answer

http://www.safechaos.net/cs.htm

pimprenelle27 · Answer

tu es sur de toi avec il y a pas autre chose pour éradiquer son virus.

old57 · Answer

tu as essayer smitfraud fix
combofix
navilog1
que faire alors google est ton ami
ou alors va ici demander https://forum.malekal.com/index.php?sid=92748754cfb7d29f2810b8546d65266d
tres bon pro de l'informatique

Aide hijackthis

13 réponses

Votre réponse

Discussions similaires

Newsletters