[virus qui renait elite bar+ click me]

Question

Ce virus me rend fou! jé essayé pas mal de chose sans succé! jé posté plusieurs hijackthis sans savoir réellement koi fixer! aider moi s'il vous plait. Je cherche moe ou petit-père! alors si vous les connaissez! voici mon dernier hijackthisScan saved at 21:37:55, on 05/13/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton Internet Security\NISUM.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\Norton Internet Security\ccPxySvc.exeC:\Program Files\sony\giga pocket\shwserv.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\UStorSrv.exeC:\Program Files\sony\giga pocket\RM_SV.exeC:\WINDOWS\System32\ezSP_Px.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exeC:\PROGRA~1\TWINTO~1\MouseElf.EXEC:\WINDOWS\AGRSMMSG.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\TwinTouch LuxeMate\EMouse.exeC:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\LightSurf\Common\IconMgr.exeC:\Program Files\LightSurf\Colorific\hgcctl95.exeC:\Program Files\sony\usbsircs\USBsircs.exeC:\Program Files\sony\giga pocket\ReserveModule.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\Program Files\LightSurf\Color Indicator\TICIcon.exeC:\Program Files\sony\giga pocket\gps.exeC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN Messenger\msnmsgr.exeD:\Mes docs\Utilitaires\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dllO2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dllO3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dllO4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exe /StartUpO4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXEO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [WmaORaV_Ml] C:\WINDOWS\System32\irkwsrvgcg.exeO4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\system32\defragfatz.exeO4 - HKLM\..\Run: [salm] c:	emp\salm.exeO4 - HKLM\..\Run: [ElSH] C:\WINDOWS\cfpwidqd.exeO4 - HKLM\..\Run: [tqrit] C:\WINDOWS	qrit.exeO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"O4 - HKLM\..\Run: [Ghqww] C:\Program Files\Gwxiki\Diqnamz.exeO4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exeO4 - HKLM\..\Run: [¢‰¸K0¨4W}ïÁzî[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\cfpwidqd.exeO4 - HKLM\..\Run: [MsnExplorer] C:\WINDOWS\msexploren.exe /iO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [gcasServ] C:\WINDOWS\gcasServ.exeO4 - HKLM\..\Run: [SheduIer] C:\WINDOWS\qttasks.exe /iO4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitedme32.exeO4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\france.exe -NO4 - HKLM\..\RunOnce: [SpybotSnD] "D:\Mes docs\Utilitaires\Spybot - Search & Destroy\SpybotSD.exe" /autocheckO4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exeO4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXEO4 - Global Startup: Adobe Gamma Loader.lnk = ?O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeO4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exeO4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: LightSurf.lnk = C:\Program Files\LightSurf\Common\IconMgr.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXEO4 - Global Startup: Pilote Remocon.lnk = C:\Program Files\sony\usbsircs\USBsircs.exeO4 - Global Startup: Timer Recording Manager.lnk = C:\Program Files\sony\giga pocket\ReserveModule.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm414YYFRO9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll (file missing)O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO15 - Trusted Zone: *.sony-europe.comO15 - Trusted Zone: *.sonystyle-europe.comO15 - Trusted Zone: *.vaio-link.comO16 - DPF: Interface Chat Voila - http://chat7.x-echo.com/version5/Applet/vchatsign.cabO16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_nos.exeO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/SmileyCentralFWBInitialSetup1.0.0.8-2.exeO16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cabO16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/cab/14/fr/SysWebTelecomInt.cabO16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.40noopt/SpySpotterCabInstall.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exeO23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\sony\giga pocket\shwserv.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\sony\giga pocket\halsv.exeO23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\sony\giga pocket\RM_SV.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exeO23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program Files\sony\vaio media music server\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\vaio media platform\sv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\vaio media platform\UPnPFramework.exeO23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exeO23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program Files\Fichiers communs\sony shared\vaio media platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Fichiers communs\sony shared\vaio media platform\UPnPFramework.exeO23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\sony\giga pocket\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Fichiers communs\sony shared\vaio media platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Fichiers communs\sony shared\vaio media platform\UPnPFramework.exe

bernie61 · Answer

saluttu as un lien là qui donne tous les fichiers à effacer et BDR à nettoyerhttp://www3.ca.com/securityadvisor/pest/pest.aspx?id=453090724dis nous quoi après si autre pbma+

himad · Answer

Dit moi koi faire bernie kan je vé sur le lien car je suis un noviss.

himad · Answer

jé été sur le lien mé je suis un noviss alors si tu pe me guider sil te plé.  merci

bernie61 · Answer

re salut
Redémarre en mode sans échec
Démarrer/exécuter/ et tapper REGEDIT
Là charcher la clef
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\
Et dans panneau droit effacer antiware
Ensuite reboot de l’ordi toujours mode sans échec

et chercher et effacer
81635062.dll
systemroot+\elitesidebar\elitesidebar 08.dll
systemroot+\elitetoolbar\elitetoolbar version 59.dll

réouvrir la BDR et effacer les clefs
HKEY_CLASSES_ROOT\clsid\{0a1d22c3-37be-470c-9c29-e3074ee0574b}
HKEY_CLASSES_ROOT\clsid\{28caeff3-0f18-4036-b504-51d73bd81abc}
HKEY_CLASSES_ROOT\clsid\{825cf5bd-8862-4430-b771-0c15c5ca8def}
HKEY_CLASSES_ROOT\clsid\{be8d0059-d24d-4919-b76f-99f4a2203647}
HKEY_CLASSES_ROOT\clsid\{ed103d9f-3070-4580-ab1e-e5c179c1ae41}
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{825cf5bd-8862-4430-b771-0c15c5ca8def}
HKEY_LOCAL_MACHINE\software\elitum
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{825cf5bd-8862-4430-b771-0c15c5ca8def}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{28caeff3-0f18-4036-b504-51d73bd81abc}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ed103d9f-3070-4580-ab1e-e5c179c1ae41}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\antiware
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\elitebar internet explorer toolbar
HKEY_LOCAL_MACHINE\software\ohbbackup

Rechercher fichier et effacer
81635062.dll
elite toolbar.exe
profilepath+\local settings\temp\suicidetb.exe
profilepath+\local settings\temporary internet files\silent_install.exe
protas.exe
protopro.exe
sideb.exe
silent53.exe
systemroot+\elitesidebar\elitesidebar 08.dll
systemroot+\elitetoolbar\elitetoolbar version 59.dll
systemroot+\system32\elitekck32.exe
systemroot+\system32\elitexdx32.exe
www.gamefly[1].com

et effacer complètement le répertoire elitetoolbar
systemroot+\elitetoolbar

vider la corbeille et redémarrer mode normal et faire un Hijackthis
a+

Utilisateur anonyme · Answer

Bon boulot !! lolc est calme ce soir :-(

bernie61 · Answer

re salut
là c'était pour ELITE
quant à Click Me
Pour trojan CHICK ME
0887ff.exe >> fichier à rechercher et effacer

mettre à jour l'antivirus et l'antitrojan et scan avec

antitrojan a2free là
http://www.emsisoft.com/en/
ou celui-là
http://www.ewido.net/en/?section=features (payant après 30j)
ou scanTrojan en ligne : http://www.windowsecurity.com/trojanscan/
ou TDS-3 là http://tds.diamondcs.com.au/ (payant )
ou TrojanHunter 4.1
http://www.misec.net/trojanhunter/ (payant après 30j)
ou The Cleaner (payant après 30j)
http://www.moosoft.com/products/cleaner/download/
a+

Utilisateur anonyme · Answer

re bernie,pour clik me, passe par hijack ca sera facile et fais en 2 min non??

Utilisateur anonyme · Answer

lol exact !! toute maniere un anti trojan est tres efficace , donc necessaire !!Bon courage ^^ et si t as besoin, bip moi lol

insomniak · Answer

salut
j'ai viré ce probleme comme ça:
desactiver restauration system
rechercher elite puis tout supprimer
rechercher france puis tout supprimer
ces 2 merdes se trouvent principalement ds system32
maintenant plus de click me ni de pop up search results
si ça peut aider!

himad · Answer

SalutAu post 5      je n'ai pas compris les mots "antiware" et "reboot".            Merci de ta compréhension bernie et excuse moi pour ma médiocrité

himad · Answer

Pour bernie: Je n'ai pas compris dans cette phrase:

Là charcher la clef
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\
Et dans panneau droit effacer antiware
Ensuite reboot de l’ordi toujours mode sans échec

les mots "antiware" et " reboot".

chui vraiment pas bon!

Utilisateur anonyme · Answer

salut himadje vois que tu jongle sur plusieurs postsune réponse pour ton log hijack ici:http://www.commentcamarche.net/forum/affich-1518782-Manip-de-Kea-pour-suppr-about-blank#5a+

himad · Answer

Merci!  moe31!  C kool ke tu soit la! je vé sur le lien indiké.

math · Answer

voila mon log je fait quoi maintenant??? help me !!!Logfile of HijackThis v1.99.1Scan saved at 16:15:08, on 15/05/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\Explorer.EXED:\WINDOWS\system32\DRIVERS\CDANTSRV.EXED:\Program Files\N37dev\LanTool\LanTool.exeD:\Program Files\Norton AntiVirus
avapsvc.exeD:\WINDOWS\System32
vsvc32.exeD:\WINDOWS\System32\svchost.exeD:\PROGRA~1\NORTON~1
avapw32.exeD:\WINDOWS\system32\RUNDLL32.EXED:\Program Files\Fichiers communs\Real\Update_OBealsched.exeD:\Program Files\MessengerPlus! 3\MsgPlus1.exeD:\Program Files\QuickTime\qttask.exeD:\Program Files\RealVNC\VNC4\WinVNC4.exeD:\Program Files\Media Access\MediaAccK.exeD:\Program Files\Media Access\MediaAccess.exeD:\WINDOWS\system32\bitxmlc.exeC:\Program Files\AutoUpdate\AutoUpdate.exeD:\WINDOWS\system32\ap9h4qmo.exeD:\WINDOWS\system32\atlvert.exeD:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeD:\Program Files\MSN Messenger\msnmsgr.exed:\progra~1\intern~1\iexplore.exeD:\WINDOWS\System32\svchost.exeD:\Program Files\ISTsvc\istsvc.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\WinRAR\WinRAR.exeD:\DOCUME~1\LAAAAA~1\LOCALS~1\Temp\Rar$EX00.859\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingF2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,,SKEYS /IO2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - D:\WINDOWS\EliteToolBar\EliteToolBar version 60.dllO2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - D:\WINDOWS\EliteSideBar\EliteSideBar 08.dllO3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - D:\WINDOWS\EliteToolBar\EliteToolBar version 60.dllO4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [hpfsched] D:\WINDOWS\hpfsched.exeO4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus1.exe"O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Media Access] D:\Program Files\Media Access\MediaAccK.exeO4 - HKLM\..\Run: [ffeyUlW] D:\WINDOWS\vbtjc.exeO4 - HKLM\..\Run: [HELPER] D:\WINDOWS\system32\france.exe  -NO4 - HKLM\..\Run: [checkrun] D:\windows\system32\elitenfz32.exeO4 - HKLM\..\Run: [233S3FQ] bitxmlc.exeO4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"O4 - HKLM\..\Run: [ap9h4qmo] D:\WINDOWS\system32\ap9h4qmo.exeO4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exeO4 - HKCU\..\Run: [32 Thunk] D:\DOCUME~1\LAAAAA~1\APPLIC~1\01pollvc\Settings Download.exeO4 - HKCU\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus1.exe" /WinStartO4 - HKCU\..\Run: [J0s2RPc3U] atlvert.exeO4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - D:\Program Files\SideFind\sidefind.dllO9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exeO9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exeO9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Program Files\IrfanView\Ebay\Ebay.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO15 - Trusted Zone: http://ny.contentmatch.net (HKLM)O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cabO16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/inflaterball/miniclipGameLoader.dllO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097771746859O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cabO16 - DPF: {AABB591F-CEB3-404A-A979-AA30B16CB914} (IPLabs Image Uploader 2.5) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader2.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cabO16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cabO16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/fr/check/qdiagh.cab?326O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cabO23 - Service: C-DillaSrv - C-Dilla Ltd - D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXEO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exeO23 - Service: LanTool - N37dev - D:\Program Files\N37dev\LanTool\LanTool.exeO23 - Service: License Management Service ESD - element5 - D:\Program Files\Fichiers communs\element5 Shared\Service\Licence Manager ESD.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32
vsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - D:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

bernie61 · Answer

salut
désinstalle MediaAcess

c'est toi qui as installé RealVNC c'est un pgm qui permet de contrôler un ordi à partir d'un autre (c'est un ordi de société??)
si c'est pas toi, désinstalles

Démarrer/panneauConfig/ajoutSuppressionProgrammes

puis refais un hijackthis
a+

bernie61 · Answer

re salut mth

1. Tu connais ça vérifie (cliq droit souris/propriété) sinon ZIP (compresse) et efface le .EXE
Efface complètement (ou désinstalle si tu trouves) répertoire EliteToolBar et celui MediaAccess, SideFind , FlashGet en mode sans échec

2. Relances Hijackthis et coche (puis FIX)
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - D:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - D:\WINDOWS\EliteSideBar\EliteSideBar 08.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - D:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
O4 - HKLM\..\Run: [ffeyUlW] D:\WINDOWS\vbtjc.exe
O4 - HKLM\..\Run: [HELPER] D:\WINDOWS\system32\france.exe -N
O4 - HKLM\..\Run: [checkrun] D:\windows\system32\elitenfz32.exe
O4 - HKLM\..\Run: [233S3FQ] bitxmlc.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [ap9h4qmo] D:\WINDOWS\system32\ap9h4qmo.exe
O4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [J0s2RPc3U] atlvert.exe
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - D:\Program Files\SideFind\sidefind.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/inflaterball/miniclipGameLoader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097771746859
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {AABB591F-CEB3-404A-A979-AA30B16CB914} (IPLabs Image Uploader 2.5) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/fr/check/qdiagh.cab?326
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

3. Effacer ces programmes .EXE ( et à la fin vider la corbeille)
C:\Program Files\AutoUpdate\AutoUpdate.exe
D:\WINDOWS\system32\ap9h4qmo.exe
D:\WINDOWS\system32\atlvert.exe
D:\Program Files\ISTsvc\istsvc.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\WINDOWS\vbtjc.exe
D:\WINDOWS\system32\france.exe -N
D:\windows\system32\elitenfz32.exe
…. bitxmlc.exe >> à rechercher et effacer
C:\Program Files\AutoUpdate\AutoUpdate.exe"
D:\WINDOWS\system32\ap9h4qmo.exe
D:\Program Files\ISTsvc\istsvc.exe
C ou D… atlvert.exe >> rechercher et effacer

4. vider les répertoires temps et la corbeille
Refais un hijackthis de contrôle
a+

bernie61 · Answer

re
désolé pour la confusion
redémarre en mode sans échec et effaces le contenu de ces répertoire
EliteToolBar
MediaAccess
SideFind
FlashGet

voilà
puis tjs en mode sans échec applique le reste point 2+3+4
a+

bernie61 · Answer

re salut
en apparence là il n'y a rien dans la restauration

mais il est vrai que si tu crées un point de restauration quand tu es infecté, immanquablement l'infection revient si tu dois te servir de ce point

quand ton ordi sera clean, alors là seulement désactive, redémarre puis réctive et crée un nouveau point;
a+

[virus qui renait elite bar+ click me]

18 réponses

Discussions similaires

Newsletters