Trojan-Spy.html.Bankfraud.ci

Question

Bonjour

Je découvre seulement ce matin votre site.

Infecte par WORM.WIN32.SOBER.p, SECURITOO m'en a débarrassé avec l'assistant de néttoyage .

Subsiste TROJAN-SPY.Html.Bankfraud.ci

J'ai un message signalant tantot que : smss.exe , tantot csrss.exe
ont été comtaminés " depuis la dernière utilisation " dans
C: DOCUMENTS AND SETTING
Merci de vos conseils .

Afficher la suite

bernie61 · Answer

salut
installes un de ces anti trojan, mettre à jour puis scan

antitrojan a2free là
http://www.emsisoft.com/en/
ou celui-là
http://www.ewido.net/en/?section=features (payant après 30j)
ou scanTrojan en ligne : http://www.windowsecurity.com/trojanscan/
ou TDS-3 là http://tds.diamondcs.com.au/ (payant )
ou TrojanHunter 4.1
http://www.misec.net/trojanhunter/ (payant après 30j)
ou The Cleaner (payant après 30j)
http://www.moosoft.com/products/cleaner/download/
a+

lepetitloup · Answer

J'ai aussi ce trojan j'arrive po a le retirer de mon pc voici mon rapport dites moi qoi faire merci a tous les prob lologfile of HijackThis v1.99.1Scan saved at 18:17:53, on 16/05/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\TGTSoft\StyleXP\StyleXPService.exeC:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exeC:\WINDOWS\system32\DRIVERS\CDANTSRV.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\msole32.exeC:\WINDOWS\system32\shnlog.exeC:\Program Files\Java\jre1.5.0_01\bin\jusched.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\system32\Launcher.exeC:\WINDOWS\TBPanel.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exeC:\PROGRA~1\LexmarkX83\ACMonitor_X83.exeC:\WINDOWS\system32\intmonp.exeC:\PROGRA~1\LexmarkX83\AcBtnMgr_X83.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_JetSend.exeC:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exeC:\PROGRA~1\Messager Wanadoo\Demon.exeC:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exeC:\WINDOWS\system32\intmon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Winamp\winampa.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exeC:\Program Files\CursorXP\CursorXP.exeC:\Program Files\TGTSoft\StyleXP\StyleXP.exeC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\WINDOWS\system32svp.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\popuper.exeC:\Program Files\The Cleaner\cleaner.exeC:\Program Files\The Cleaner	ca.exeC:\Program Files\The Cleaner	cm.exeC:\Program Files\WinRAR\WinRAR.exeC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.671\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.quicknavigate.com/search.php?qq=%1R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.quicknavigate.com/bar.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.quicknavigate.com/search.php?qq=%1R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qfind.net/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.quicknavigate.com/search.php?qq=%1R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.quicknavigate.com/search.php?qq=%1R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.quicknavigate.com/search.php?qq=%1R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.quicknavigate.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SearchPageURL.dllF2 - REG:system.ini: Shell=explorer.exe, msmsgs.exeO2 - BHO: (no name) - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - C:\WINDOWS\system32\hp31B9.tmpO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\system32\Launcher.exeO4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /AO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /waitO4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LexmarkX83\ACMonitor_X83.exeO4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LexmarkX83\AcBtnMgr_X83.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKLM\..\Run: [HPIJetSend] C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_JetSend.exeO4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [Demon] C:\PROGRA~1\Messager Wanadoo\Demon.exeO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exeO4 - HKLM\..\Run: [EasyMessage] "C:\Program Files\Zango Messenger\em2.exe" -waitO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" -autorunO4 - HKLM\..\Run: [Sin Espias] C:\Program Files\SinEspias\No-Spy.exe /autorunO4 - HKLM\..\Run: [Sans Espions] "C:\Program Files\SinEspias\No-Spy.exe" /autorunO4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner	ca.exeO4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner	cm.exeO4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exeO4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -HideO4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"O4 - HKCU\..\Run: [WindowsFY] c:\bsw.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLLO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by WebHancerO16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{345EB7D1-E3BA-4727-89C1-62A4632B4873}: NameServer = 69.50.184.84,195.225.176.37O17 - HKLM\System\CCS\Services\Tcpip\..\{B64DD56B-9113-48CF-BC26-26CFC703F1AE}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CCS\Services\Tcpip\..\{EEA7FA22-A91D-43E8-B090-60D98408355F}: NameServer = 69.50.184.84,195.225.176.37O17 - HKLM\System\CS1\Services\Tcpip\..\{345EB7D1-E3BA-4727-89C1-62A4632B4873}: NameServer = 69.50.184.84,195.225.176.37O17 - HKLM\System\CS2\Services\Tcpip\..\{345EB7D1-E3BA-4727-89C1-62A4632B4873}: NameServer = 69.50.184.84,195.225.176.37O18 - Filter: text/html - {2F166B86-5420-4312-8BDB-BD2C55D26D3A} - C:\WINDOWS\system32\kpkk.dllO18 - Filter: text/plain - {2F166B86-5420-4312-8BDB-BD2C55D26D3A} - C:\WINDOWS\system32\kpkk.dllO20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\Object Desktop\WindowBlinds\fastload.dllO23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /Service (file missing)O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXEO23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpm.exe" /Service (file missing)O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

jim · Answer

Bonjour moi je ses coment détruire trojan mais il rapparais chaque fois que je veu jouer a mon jeux sela fais  3 ans que je joue a se jeux et jamais rien ne c.étais passer mais la quand je fais PLAY sela dit treats detected je le détruit mais il rapparais pouver vous m'aider a me proteger comptre les trojan clicker.NES

Trojan-Spy.html.Bankfraud.ci

3 réponses

Votre réponse

Discussions similaires

Newsletters