VIRUS TROJAN Fermé

Question

BONJOURJE DEMANDE DE L'AIDE SVP AU SUJET DU VIRUS TROJANJ'AI UN MESSAGE D'ERREUR  : A FATAL ERROR IN ie HAS OCCURED OOO1OE36 BY TROJAN.SVP M'AIDEZ

regis59 · Answer

slt télécharge hijackthis ici: http://www.hijackthis.de/downloads/hijackthis_199.zip L'aide est ici: http://www.zebulon.fr/articles/HijackThis.php Dezippz le dans un dossier prévu a cet effet. Par exemple C:\hijackthis lancez le puis: clic sur "do a system scan and save logfile" faire un copier coller du log entier sur le foruma++

jimmo · Answer

Bonjour, moi aussi je suis embété par des trojans que j'arrive pas à désinfecter.Je me permets de mettre mon log ici, si quelqu'un pouvait l'analyser ce serait sympa. Merci.Logfile of HijackThis v1.99.1Scan saved at 16:16:44, on 16/04/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:G:\WINDOWS\System32\smss.exeG:\WINDOWS\system32\winlogon.exeG:\WINDOWS\system32\services.exeG:\WINDOWS\system32\lsass.exeG:\WINDOWS\system32\svchost.exeG:\WINDOWS\System32\svchost.exeG:\WINDOWS\Explorer.EXEG:\WINDOWS\system32\spoolsv.exeG:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeG:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeG:\WINDOWS\System32\svchost.exeG:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeG:\Program Files\Fichiers communs\Real\Update_OBealsched.exeG:\WINDOWS\system32\carpserv.exeG:\Program Files\D-Tools\daemon.exeG:\WINDOWS\SOUNDMAN.EXEG:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exeG:\WINDOWS\NCLAUNCH.EXeG:\Program Files\Spybot - Search & Destroy\TeaTimer.exeG:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeG:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exeG:\WINDOWS\System32undll32.exeG:\Program Files\eMule\emule.exeG:\Program Files\MSN Messenger\msnmsgr.exeG:\Program Files\Copystar\CDMate\CDMate.exeG:\Program Files\Internet Explorer\iexplore.exeG:\DOCUME~1\session1\LOCALS~1\Temp\Répertoire temporaire 3 pour hijackthis_199.zip\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.huvqbognounwmknwtk.com/SfuoQYeF6_b7AWBh9Qz187DLkQdKQulAdyBlAZvChkqjrhwEdFWgC10IdNK4y30D.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - G:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)O4 - HKLM\..\Run: [ATIPTA] G:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [LAN Driver] landriver32.exeO4 - HKLM\..\Run: [90ae34.exe] 90ae34.exeO4 - HKLM\..\Run: [istinstall_zazzer.exe] istinstall_zazzer.exeO4 - HKLM\..\Run: [vnmispoisn_downloader.exe] vnmispoisn_downloader.exeO4 - HKLM\..\Run: [Microsoft Works Update Detection] G:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [PinnacleDriverCheck] G:\WINDOWS\System32\PSDrvCheck.exeO4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [CARPService] carpserv.exeO4 - HKLM\..\Run: [Whatever] G:\DOCUME~1\session1\LOCALS~1\Temp	orax.exeO4 - HKLM\..\Run: [DAEMON Tools-1033] "G:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [LogitechVideoRepair] G:\Program Files\Logitech\Video\ISStart.exeO4 - HKLM\..\Run: [AVG7_CC] G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUPO4 - HKLM\..\Run: [ccApp] "G:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "G:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [adiras] adiras.exeO4 - HKLM\..\Run: [Microsoft Update] esplorer.exeO4 - HKLM\..\RunServices: [Microsoft Update] esplorer.exeO4 - HKLM\..\RunServices: [LAN Driver] landriver32.exeO4 - HKCU\..\Run: [ATI Launchpad] "G:\Program Files\ATI Multimedia\main\launchpd.exe"O4 - HKCU\..\Run: [ATI Remote Control] G:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exeO4 - HKCU\..\Run: [Microsoft Update] esplorer.exeO4 - HKCU\..\Run: [LAN Driver] landriver32.exeO4 - HKCU\..\Run: [MoneyAgent] "G:\Program Files\Microsoft Money\System\mnyexpr.exe"O4 - HKCU\..\Run: [NCLaunch] G:\WINDOWS\NCLAUNCH.EXeO4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Startup: wkcalrem.LNK = G:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exeO4 - Global Startup: DSLMON.lnk = G:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office\OSA9.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\WINDOWS\System32\msjava.dllO9 - Extra button: MrBookmaker Poker - {1DAA624F-A7AB-4b31-97A4-67205FF6963C} - G:\Program Files\mrbookmakerfrMPP\MPPoker.exeO9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - G:\Program Files\ATI Multimedia	v\EXPLBAR.DLLO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - G:\Program Files\AIM95\aim.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exeO16 - DPF: Interface Chat Voila - http://chat5.x-echo.com/version5/Applet/vchatsign.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} (InstallerObj Class) - http://videohd.m6.fr.ipercast.net/installer-hidden.cabO16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} - http://www.miniclip.com/bestfriends/retro64_loader.dllO16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CABO16 - DPF: {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C} (ActiveFormX Contrôle) - http://selfcare.cegetel.net/templates/static/ocx/AFAutoConfig.ocxO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cabO16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.0 Combo Control) - http://www.misterclic.fr/Components/Upload/ImageUploader3.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cabO16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cabO16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://kit.carpediem.fr/15239/xgratos.exeO16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://photos02.aol.fr/ygp/aol/plugin/download/YGPPicDownload.fr-FR.9.1.6.18.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cabO16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.misterclic.fr/XUpload.ocxO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4468/mcfscan.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{BA6D762E-4767-4512-8380-2D9BBC8CDD9A}: NameServer = 217.19.192.131 217.19.192.132O23 - Service: Ati HotKey Poller - Unknown owner - G:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeO23 - Service: LogoMedia TranslateDotNet Server - Unknown owner - G:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe (file missing)O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - G:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

regis59 · Answer

salut jimmo, cree toi meme ton poste stp et explique au plus clair ton probleme stp merci, ce sera plus simple et plus facile pour te repondrea++

samextrading · Answer

voici mon logLogfile of HijackThis v1.99.1Scan saved at 21:27:24, on 16/04/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exeC:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeC:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXEC:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\sm56hlpr.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\FaxTalk Communicator\FTCtrl32.exeC:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exeC:\Program Files\a2\a2guard.exeC:\Program Files\Messenger\msmsgs.exeC:\wp.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXEC:\Program Files\FaxTalk Communicator\FAPIEXE.EXEC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\ArcSoft\PhotoStudio 2000\PhotoStudio.exeC:\Program Files\Fichiers communs\Real\Update_OBnathchk.exeC:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEC:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Outlook Express\msimn.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\OPScan.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\WinRAR\WinRAR.exeC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.641\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/230/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exeO4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoloadO4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startupO4 - HKCU\..\Run: [klop] C:\WINDOWS\System32\39.exeO4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [WindowsFY] c:\wp.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Microsoft AntiSpyware helper - {2AF4FF47-F6EB-4458-ACE4-15CE3FF1A778} - (no file) (HKCU)O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2AF4FF47-F6EB-4458-ACE4-15CE3FF1A778} - (no file) (HKCU)O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SAMEXO17 - HKLM\Software\..\Telephony: DomainName = SAMEXO17 - HKLM\System\CCS\Services\Tcpip\..\{AD0FE7FD-B70A-4532-8EFC-BBABA441B917}: NameServer = 193.251.143.162 194.51.3.49O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SAMEXO17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = SAMEXO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXEO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE

regis59 · Answer

salut,tu peux fixer ca:C:\wp.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/230/O4 - HKCU\..\Run: [klop] C:\WINDOWS\System32\39.exe O4 - HKCU\..\Run: [WindowsFY] c:\wp.exea++

samextrading · Answer

Merci beaucoup pour ton aide.  Mais j'ai toujours le même prob. j'arrive a effacer le 39.exe et le wp.exe mais impossible deliminer  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/230/  J'ai toujours l'ecran bleu et IE m'affiche hotoffers.com  Encore merci pour ton aide

regis59 · Answer

salut pour cela:39.exe et le wp.exe essai ctlr+alt+suppr < puis dans processus et si tu trouve ces 2 la , termine le processusa++

OLIVER · Answer

Logfile of HijackThis v1.99.1Scan saved at 20:46:53, on 17/04/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\Smtray.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\WINDOWS\system32\RUNDLL32.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\WINDOWS\system32\addte32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\eMule\emule.exeC:\Program Files\Sony Corporation\Image Transfer\SonyTray.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\IncrediMail\bin\IncMail.exeC:\PROGRA~1\INCRED~1\bin\IMApp.exeC:\Program Files\Internet Explorer\iexplore.exeC:\DOCUME~1\VALERIE\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis_199.zip\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\bqbxh.dll/sp.html#44980R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bqbxh.dll/sp.html#44980R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\bqbxh.dll/sp.html#44980R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\bqbxh.dll/sp.html#44980R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bqbxh.dll/sp.html#44980R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\bqbxh.dll/sp.html#44980R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\bqbxh.dll/sp.html#44980R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {77CFFB1B-9A9A-5B55-F605-56A98395ABB5} - C:\WINDOWS\mfcut.dllO4 - HKLM\..\Run: [Smapp] Smtray.exeO4 - HKLM\..\Run: [Watch] C:\PROGRA~1\Minitel\Watch.exeO4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exeO4 - HKLM\..\Run: [Microsoft DirectX] wuamgrd.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXEO4 - HKLM\..\Run: [WinDriv32] C:\WINDOWS\system32\WinDriv32.exeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [ICQ Net] C:\WINDOWS\winlogon.exe -stealthO4 - HKLM\..\Run: [_Hazafibb] C:\WINDOWS\system32\ylkspwsl.exeO4 - HKLM\..\Run: [Norton Antivirus AV] C:\WINDOWS\FVProtect.exeO4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMainO4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKLM\..\Run: [addte32.exe] C:\WINDOWS\system32\addte32.exeO4 - HKLM\..\RunServices: [Microsoft DirectX] wuamgrd.exeO4 - HKLM\..\RunOnce: [javalp32.exe] C:\WINDOWS\javalp32.exeO4 - HKLM\..\RunOnce: [wincq32.exe] C:\WINDOWS\wincq32.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Microsoft DirectX] wuamgrd.exeO4 - HKCU\..\Run: [WinDriv32] C:\WINDOWS\system32\WinDriv32.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1029.dll,InstantAccessO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStartO4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: Sites Perso - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)O9 - Extra 'Tools' menuitem: Compaq France - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/mickey/fr/win/QuickTimeInstaller.exeO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092945704390O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://16755.dialer.lincassa.com/ParisVoyeur.exeO16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/fr/SysWebTelecom.cabO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE (file missing)O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Unknown owner - C:\Program Files\Norton Internet Security\SymProxySvc.exe (file missing)O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

regis59 · Answer

oliver quel est ton probleme, explik toi avant de poser celamerci a++

samextrading · Answer

MERCI POUR TON AIDEJ'AI EFFACER LE 39.EXE DANS LE PROCESSUSMAIS MON PROBLEME N'EST TJ PAS REGLEMAIS JE RETROUVE MON DESKTOP PAS D'ECRAN BLEUEJ'AI FAIS RECHERCHER LES FICHIERS 39.EXEET JAI 3 FICHIERSVOICI CE QUE JE TROUVE   LE PREMIER DANS C:\WINDOWS \PrefectLE 2IE  DANS C:\WINDOWSLE 3IE  DANS C:\WINDOWS\System32

regis59 · Answer

Personnellement je le supprimerais partout mais la dessu j en suis pas certain !

samextrading · Answer

Bonjour Regis59Je suis tj  dans la merde.le 39.exe est tj la et hotofferts auusiJ'ai quand-même effacer le premier 39.exeil me reste 2 autresOutloook me demande a chaque fois de reconfigureret je perts mes messagessvp de l'aidevoici mon log encoreLogfile of HijackThis v1.99.1Scan saved at 12:15:27, on 20/04/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exeC:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeC:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXEC:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\FaxTalk Communicator\FTCtrl32.exeC:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exeC:\WINDOWS\System32\CTFMON.EXEC:\Program Files\Messenger\msmsgs.exeC:\Program Files\FaxTalk Communicator\FAPIEXE.EXEC:\Program Files\Outlook Express\msimn.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Fichiers communs\Symantec Shared\NMain.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\WinRAR\WinRAR.exeC:\DOCUME~1\TEMP~1.SAM\LOCALS~1\Temp\Rar$EX00.718\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/230/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://quickmetasearch.com/?said=acc0000_hoR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: HomePageCtrl Class - {1B9CB0F8-118B-49C1-956D-B703E976F8E3} - C:\Program Files\STHomePage\STHomePage2.dllO2 - BHO: STLinksCtrl Class - {B54BFA47-D897-49CA-9657-05EC9F80A32B} - C:\Program Files\STLinks\STLinks2.dllO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoloadO4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startupO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [klop] C:\WINDOWS\System32\39.exeO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SAMEXO17 - HKLM\Software\..\Telephony: DomainName = SAMEXO17 - HKLM\System\CCS\Services\Tcpip\..\{AD0FE7FD-B70A-4532-8EFC-BBABA441B917}: NameServer = 193.251.143.162 194.51.3.49O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SAMEXO17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = SAMEXO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXEO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE

regis59 · Answer

salutpour autofoders:va faire un tour ici, les solutions y sont !http://www.commentcamarche.net/forum/affich-1381998-Probleme-Hotoffers#2005-04-19%2013%3A58%3A23a++

VIRUS TROJAN

13 réponses

Discussions similaires

Newsletters