Trojan indestructibles...
Damien
-
d0ne Messages postés 1019 Statut Membre -
d0ne Messages postés 1019 Statut Membre -
Salut à tous
des soucis encore des soucis, un trojan.cachecachekit, qui reapparait sans arrêt ... des fenetres intempestives qui s'ouvrent -j'ai tout essayé, adaware, spybot+ clean up et norton, passés en sans echec mais tjrs des problemes.. Voici le dernier log hijack - qui pourrait me conseiller ?
Merci d'avance !
Logfile of HijackThis v1.99.1
Scan saved at 22:34:02, on 27/06/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\x.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\phqg.EXE
C:\WINDOWS\System32\svghost.exe
C:\WINDOWS\System32\ctfmon.exe
c:\windows\system32\vdfuvdc.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\phqg.EXE
C:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O1 - Hosts: 204.9.190.180 onlineaccounts2.abbeynational.co.uk
O1 - Hosts: 204.9.190.180 www3.aibgbonline.co.uk
O1 - Hosts: 204.9.190.180 www.bank.alliance-leicester.co.uk
O1 - Hosts: 204.9.190.180 login.iblogin.com
O1 - Hosts: 204.9.190.180 ww2.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 204.9.190.180 inet.barclays.co.uk
O1 - Hosts: 204.9.190.180 iibank.barclays.co.uk
O1 - Hosts: 204.9.190.180 iibank.cahoot.com
O1 - Hosts: 204.9.190.180 www3.coventrybuildingsociety.co.uk
O1 - Hosts: 204.9.190.180 ww.hsbc.co.uk
O1 - Hosts: 204.9.190.180 login.ebank.offshore.hsbc.co.je
O1 - Hosts: 204.9.190.180 ww3.online-offshore.lloydstsb.com
O1 - Hosts: 204.9.190.180 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 204.9.190.180 ww3.online.lloydstsb.co.uk
O1 - Hosts: 204.9.190.180 ob2.nationet.com
O1 - Hosts: 204.9.190.180 ww3.onlinebanking.natwestoffshore.com
O1 - Hosts: 204.9.190.180 ww1.nwolb.com
O1 - Hosts: 204.9.190.180 ww1.onlinebanking.iombank.com
O1 - Hosts: 204.9.190.180 ww1.www.rbsdigital.com
O1 - Hosts: 204.9.190.180 welcome.smile.co.uk
O1 - Hosts: 204.9.190.180 login.365online.com
O1 - Hosts: 204.9.190.180 wvw.citizensbankonline.com
O1 - Hosts: 204.9.190.180 esecure.regionsnet.com
O1 - Hosts: 204.9.190.180 rollb.associatedbank.com
O1 - Hosts: 204.9.190.180 upb.unionplanters.com
O1 - Hosts: 204.9.190.180 www.onlinebanking.huntington.com
O1 - Hosts: 204.9.190.180 inet.southtrustonlinebanking.com
O1 - Hosts: 204.9.190.180 logon.personal.wamu.com
O1 - Hosts: 204.9.190.180 login.compassweb.com
O1 - Hosts: 204.9.190.180 logon.firstmeritib.com
O1 - Hosts: 204.9.190.180 login.ccfcuonline.org
O1 - Hosts: 204.9.190.180 ww3.etimebanker.bankofthewest.com
O1 - Hosts: 204.9.190.180 www.onlinebanking.lasallebank.com
O1 - Hosts: 204.9.190.180 wvw.totallyfreebanking.com
O1 - Hosts: 204.9.190.180 www.online.wellsfargo.com
O1 - Hosts: 204.9.190.180 ww2.onlinebanking.bankofoklahoma.com
O1 - Hosts: 204.9.190.180 accounts4.keybank.com
O1 - Hosts: 204.9.190.180 logon.bankone.com
O1 - Hosts: 204.9.190.180 www.secure.tdbanknorth.com
O1 - Hosts: 204.9.190.180 www.secure.mvnt4.com
O1 - Hosts: 204.9.190.180 ww.mynfbonline.com
O1 - Hosts: 204.9.190.180 login.forumcuonline.com
O1 - Hosts: 204.9.190.180 www.eds.usersonlnet.com
O1 - Hosts: 204.9.190.180 www.onlineid.bankofamerica.com
O1 - Hosts: 204.9.190.180 wvw.e-gold.com
O1 - Hosts: 204.9.190.180 pcbs.peoples.com
O1 - Hosts: 204.9.190.180 www.global1.onlinebank.com
O1 - Hosts: 204.9.190.180 ww2.mybranch.lafcu.com
O1 - Hosts: 204.9.190.180 login.webbanking.comerica.com
O1 - Hosts: 204.9.190.180 web.banking.firsttennessee.com
O1 - Hosts: 204.9.190.180 logon.members1st.org
O1 - Hosts: 204.9.190.180 www.cib.ibanking-services.com
O1 - Hosts: 204.9.190.180 www.miwebbusbank.ebanking-services.com
O1 - Hosts: 204.9.190.180 wvw.paypal.com
O1 - Hosts: 204.9.190.180 www.signin.ebay.com
O1 - Hosts: 204.9.190.180 www.bvi.bancodevalencia.es
O1 - Hosts: 204.9.190.180 extrant.banesto.es
O1 - Hosts: 204.9.190.180 banesnt.banesto.es
O1 - Hosts: 204.9.190.180 activia.caixagalicia.es
O1 - Hosts: 204.9.190.180 www.bancae.caixapenedes.com
O1 - Hosts: 204.9.190.180 login.caixasabadell.net
O1 - Hosts: 204.9.190.180 oii.cajamadrid.es
O1 - Hosts: 204.9.190.180 login.cajamar.es
O1 - Hosts: 204.9.190.180 login.ccm.es
O1 - Hosts: 204.9.190.180 ww.unicaja.es
O1 - Hosts: 204.9.190.180 ww.bayernlb.de
O1 - Hosts: 204.9.190.180 ww2.berliner-volksbank.de
O1 - Hosts: 204.9.190.180 ww7.homebanking-berlin.de
O1 - Hosts: 204.9.190.180 portal09.commerzbanking.de
O1 - Hosts: 204.9.190.180 www.onlinebanking.huntington.com
O1 - Hosts: 204.9.190.180 www.meine.deutsche-bank.de
O1 - Hosts: 204.9.190.180 ww2.dresdner-privat.de
O1 - Hosts: 204.9.190.180 ww.e-banking.helaba.de
O1 - Hosts: 204.9.190.180 ww.hsh-nordbank.de
O1 - Hosts: 204.9.190.180 www.my.hypovereinsbank.de
O1 - Hosts: 204.9.190.180 ww3.homebanking-berlin.de
O1 - Hosts: 204.9.190.180 www.banking.lbbw.de
O1 - Hosts: 204.9.190.180 lrp.sparkasse-banking.de
O1 - Hosts: 204.9.190.180 ww3.homebanking-niedersachsen.de
O1 - Hosts: 204.9.190.180 www.onlinebanking.norisbank.de
O1 - Hosts: 204.9.190.180 www.banking.postbank.de
O1 - Hosts: 204.9.190.180 ww.bics.fr
O1 - Hosts: 204.9.190.180 www.co.caixabank.fr
O1 - Hosts: 204.9.190.180 ww.creditmutuel.fr
O1 - Hosts: 204.9.190.180 internetbank.intesabci.it
O1 - Hosts: 204.9.190.180 ww.extensive.bancalombarda.it
O1 - Hosts: 204.9.190.180 wvw.csebanking.it
O1 - Hosts: 204.9.190.180 www.mybank.bybank.it
O1 - Hosts: 204.9.190.180 ww.isideonline.it
O1 - Hosts: 204.9.190.180 ww3.sella.it
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {EE77BECD-00FF-CBCC-3187-BA906096E764} - C:\WINDOWS\FYI\irwnkemavy.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Fichiers communs\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MS Auto-IPSec Protection] MSASP32.exe
O4 - HKLM\..\Run: [x] x.exe
O4 - HKLM\..\Run: [Netbios Helper] C:\WINDOWS\System32\nbthlp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VCXD Settings] phqg.EXE
O4 - HKLM\..\Run: [GodMPIZUK] C:\WINDOWS\rlgkuovy.exe
O4 - HKLM\..\Run: [Microsoft Update] svghost.exe
O4 - HKLM\..\Run: [WeirdOnTheWeb] "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe"
O4 - HKLM\..\Run: [jp7dq8c2] C:\WINDOWS\System32\jp7dq8c2.exe
O4 - HKLM\..\Run: [tzvfuft] c:\windows\system32\vdfuvdc.exe r
O4 - HKLM\..\RunServices: [MS Auto-IPSec Protection] MSASP32.exe
O4 - HKLM\..\RunServices: [x] x.exe
O4 - HKLM\..\RunServices: [VCXD Settings] phqg.EXE
O4 - HKLM\..\RunServices: [Microsoft Update] svghost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKCU\..\Run: [Voissa No Pubs] C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MS Auto-IPSec Protection] MSASP32.exe
O4 - HKCU\..\Run: [VCXD Settings] phqg.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajouter un Pop-Up - {DE39E849-A37D-4126-8AE1-1551364ADA96} - C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe
O9 - Extra 'Tools' menuitem: Tools Menu Item - {DE39E849-A37D-4126-8AE1-1551364ADA96} - C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: Interface Chat Wanadoo - http://chat7.x-echo.com/version6/Applet/wchatsign.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E66CB0B-C06C-4F24-81F5-F47889AE4945}: NameServer = 80.118.196.42 80.118.192.112
O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Handling the DHCP requests (DHCP Client) - Unknown owner - C:\WINDOWS\System32\dhcpclient.exe
O23 - Service: Windows lsass Service (lsass) - Unknown owner - C:\WINDOWS\lsass.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\System32\r_server.exe" /service (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Update Service - Unknown owner - C:\WINDOWS\pwnsvc.exe (file missing)
des soucis encore des soucis, un trojan.cachecachekit, qui reapparait sans arrêt ... des fenetres intempestives qui s'ouvrent -j'ai tout essayé, adaware, spybot+ clean up et norton, passés en sans echec mais tjrs des problemes.. Voici le dernier log hijack - qui pourrait me conseiller ?
Merci d'avance !
Logfile of HijackThis v1.99.1
Scan saved at 22:34:02, on 27/06/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\x.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\phqg.EXE
C:\WINDOWS\System32\svghost.exe
C:\WINDOWS\System32\ctfmon.exe
c:\windows\system32\vdfuvdc.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\phqg.EXE
C:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O1 - Hosts: 204.9.190.180 onlineaccounts2.abbeynational.co.uk
O1 - Hosts: 204.9.190.180 www3.aibgbonline.co.uk
O1 - Hosts: 204.9.190.180 www.bank.alliance-leicester.co.uk
O1 - Hosts: 204.9.190.180 login.iblogin.com
O1 - Hosts: 204.9.190.180 ww2.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 204.9.190.180 inet.barclays.co.uk
O1 - Hosts: 204.9.190.180 iibank.barclays.co.uk
O1 - Hosts: 204.9.190.180 iibank.cahoot.com
O1 - Hosts: 204.9.190.180 www3.coventrybuildingsociety.co.uk
O1 - Hosts: 204.9.190.180 ww.hsbc.co.uk
O1 - Hosts: 204.9.190.180 login.ebank.offshore.hsbc.co.je
O1 - Hosts: 204.9.190.180 ww3.online-offshore.lloydstsb.com
O1 - Hosts: 204.9.190.180 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 204.9.190.180 ww3.online.lloydstsb.co.uk
O1 - Hosts: 204.9.190.180 ob2.nationet.com
O1 - Hosts: 204.9.190.180 ww3.onlinebanking.natwestoffshore.com
O1 - Hosts: 204.9.190.180 ww1.nwolb.com
O1 - Hosts: 204.9.190.180 ww1.onlinebanking.iombank.com
O1 - Hosts: 204.9.190.180 ww1.www.rbsdigital.com
O1 - Hosts: 204.9.190.180 welcome.smile.co.uk
O1 - Hosts: 204.9.190.180 login.365online.com
O1 - Hosts: 204.9.190.180 wvw.citizensbankonline.com
O1 - Hosts: 204.9.190.180 esecure.regionsnet.com
O1 - Hosts: 204.9.190.180 rollb.associatedbank.com
O1 - Hosts: 204.9.190.180 upb.unionplanters.com
O1 - Hosts: 204.9.190.180 www.onlinebanking.huntington.com
O1 - Hosts: 204.9.190.180 inet.southtrustonlinebanking.com
O1 - Hosts: 204.9.190.180 logon.personal.wamu.com
O1 - Hosts: 204.9.190.180 login.compassweb.com
O1 - Hosts: 204.9.190.180 logon.firstmeritib.com
O1 - Hosts: 204.9.190.180 login.ccfcuonline.org
O1 - Hosts: 204.9.190.180 ww3.etimebanker.bankofthewest.com
O1 - Hosts: 204.9.190.180 www.onlinebanking.lasallebank.com
O1 - Hosts: 204.9.190.180 wvw.totallyfreebanking.com
O1 - Hosts: 204.9.190.180 www.online.wellsfargo.com
O1 - Hosts: 204.9.190.180 ww2.onlinebanking.bankofoklahoma.com
O1 - Hosts: 204.9.190.180 accounts4.keybank.com
O1 - Hosts: 204.9.190.180 logon.bankone.com
O1 - Hosts: 204.9.190.180 www.secure.tdbanknorth.com
O1 - Hosts: 204.9.190.180 www.secure.mvnt4.com
O1 - Hosts: 204.9.190.180 ww.mynfbonline.com
O1 - Hosts: 204.9.190.180 login.forumcuonline.com
O1 - Hosts: 204.9.190.180 www.eds.usersonlnet.com
O1 - Hosts: 204.9.190.180 www.onlineid.bankofamerica.com
O1 - Hosts: 204.9.190.180 wvw.e-gold.com
O1 - Hosts: 204.9.190.180 pcbs.peoples.com
O1 - Hosts: 204.9.190.180 www.global1.onlinebank.com
O1 - Hosts: 204.9.190.180 ww2.mybranch.lafcu.com
O1 - Hosts: 204.9.190.180 login.webbanking.comerica.com
O1 - Hosts: 204.9.190.180 web.banking.firsttennessee.com
O1 - Hosts: 204.9.190.180 logon.members1st.org
O1 - Hosts: 204.9.190.180 www.cib.ibanking-services.com
O1 - Hosts: 204.9.190.180 www.miwebbusbank.ebanking-services.com
O1 - Hosts: 204.9.190.180 wvw.paypal.com
O1 - Hosts: 204.9.190.180 www.signin.ebay.com
O1 - Hosts: 204.9.190.180 www.bvi.bancodevalencia.es
O1 - Hosts: 204.9.190.180 extrant.banesto.es
O1 - Hosts: 204.9.190.180 banesnt.banesto.es
O1 - Hosts: 204.9.190.180 activia.caixagalicia.es
O1 - Hosts: 204.9.190.180 www.bancae.caixapenedes.com
O1 - Hosts: 204.9.190.180 login.caixasabadell.net
O1 - Hosts: 204.9.190.180 oii.cajamadrid.es
O1 - Hosts: 204.9.190.180 login.cajamar.es
O1 - Hosts: 204.9.190.180 login.ccm.es
O1 - Hosts: 204.9.190.180 ww.unicaja.es
O1 - Hosts: 204.9.190.180 ww.bayernlb.de
O1 - Hosts: 204.9.190.180 ww2.berliner-volksbank.de
O1 - Hosts: 204.9.190.180 ww7.homebanking-berlin.de
O1 - Hosts: 204.9.190.180 portal09.commerzbanking.de
O1 - Hosts: 204.9.190.180 www.onlinebanking.huntington.com
O1 - Hosts: 204.9.190.180 www.meine.deutsche-bank.de
O1 - Hosts: 204.9.190.180 ww2.dresdner-privat.de
O1 - Hosts: 204.9.190.180 ww.e-banking.helaba.de
O1 - Hosts: 204.9.190.180 ww.hsh-nordbank.de
O1 - Hosts: 204.9.190.180 www.my.hypovereinsbank.de
O1 - Hosts: 204.9.190.180 ww3.homebanking-berlin.de
O1 - Hosts: 204.9.190.180 www.banking.lbbw.de
O1 - Hosts: 204.9.190.180 lrp.sparkasse-banking.de
O1 - Hosts: 204.9.190.180 ww3.homebanking-niedersachsen.de
O1 - Hosts: 204.9.190.180 www.onlinebanking.norisbank.de
O1 - Hosts: 204.9.190.180 www.banking.postbank.de
O1 - Hosts: 204.9.190.180 ww.bics.fr
O1 - Hosts: 204.9.190.180 www.co.caixabank.fr
O1 - Hosts: 204.9.190.180 ww.creditmutuel.fr
O1 - Hosts: 204.9.190.180 internetbank.intesabci.it
O1 - Hosts: 204.9.190.180 ww.extensive.bancalombarda.it
O1 - Hosts: 204.9.190.180 wvw.csebanking.it
O1 - Hosts: 204.9.190.180 www.mybank.bybank.it
O1 - Hosts: 204.9.190.180 ww.isideonline.it
O1 - Hosts: 204.9.190.180 ww3.sella.it
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {EE77BECD-00FF-CBCC-3187-BA906096E764} - C:\WINDOWS\FYI\irwnkemavy.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Fichiers communs\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MS Auto-IPSec Protection] MSASP32.exe
O4 - HKLM\..\Run: [x] x.exe
O4 - HKLM\..\Run: [Netbios Helper] C:\WINDOWS\System32\nbthlp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VCXD Settings] phqg.EXE
O4 - HKLM\..\Run: [GodMPIZUK] C:\WINDOWS\rlgkuovy.exe
O4 - HKLM\..\Run: [Microsoft Update] svghost.exe
O4 - HKLM\..\Run: [WeirdOnTheWeb] "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe"
O4 - HKLM\..\Run: [jp7dq8c2] C:\WINDOWS\System32\jp7dq8c2.exe
O4 - HKLM\..\Run: [tzvfuft] c:\windows\system32\vdfuvdc.exe r
O4 - HKLM\..\RunServices: [MS Auto-IPSec Protection] MSASP32.exe
O4 - HKLM\..\RunServices: [x] x.exe
O4 - HKLM\..\RunServices: [VCXD Settings] phqg.EXE
O4 - HKLM\..\RunServices: [Microsoft Update] svghost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKCU\..\Run: [Voissa No Pubs] C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MS Auto-IPSec Protection] MSASP32.exe
O4 - HKCU\..\Run: [VCXD Settings] phqg.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajouter un Pop-Up - {DE39E849-A37D-4126-8AE1-1551364ADA96} - C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe
O9 - Extra 'Tools' menuitem: Tools Menu Item - {DE39E849-A37D-4126-8AE1-1551364ADA96} - C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: Interface Chat Wanadoo - http://chat7.x-echo.com/version6/Applet/wchatsign.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E66CB0B-C06C-4F24-81F5-F47889AE4945}: NameServer = 80.118.196.42 80.118.192.112
O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Handling the DHCP requests (DHCP Client) - Unknown owner - C:\WINDOWS\System32\dhcpclient.exe
O23 - Service: Windows lsass Service (lsass) - Unknown owner - C:\WINDOWS\lsass.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\System32\r_server.exe" /service (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Update Service - Unknown owner - C:\WINDOWS\pwnsvc.exe (file missing)
A voir également:
- Trojan indestructibles...
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Anti trojan - Télécharger - Antivirus & Antimalwares
- Virus trojan al11 ✓ - Forum Virus
- Csrss.exe trojan fr ✓ - Forum Virus
- Trojan win32 - Forum Virus
2 réponses
salut
tu fais une mise à jour de ton antivirus et scan avec
ensuite antitrojan là
antitrojan a2free là
http://www.emsisoft.com/en/
ou celui-là
http://www.ewido.net/en/?section=features (payant après 30j)
ou scanTrojan en ligne : http://www.windowsecurity.com/trojanscan/
ou TDS-3 là http://tds.diamondcs.com.au/ (payant )
ou TrojanHunter 4.1
http://www.misec.net/trojanhunter/ (payant après 30j)
ou The Cleaner (payant après 30j)
http://www.moosoft.com/products/cleaner/download/
puis refais un Hijackthis
a+
tu fais une mise à jour de ton antivirus et scan avec
ensuite antitrojan là
antitrojan a2free là
http://www.emsisoft.com/en/
ou celui-là
http://www.ewido.net/en/?section=features (payant après 30j)
ou scanTrojan en ligne : http://www.windowsecurity.com/trojanscan/
ou TDS-3 là http://tds.diamondcs.com.au/ (payant )
ou TrojanHunter 4.1
http://www.misec.net/trojanhunter/ (payant après 30j)
ou The Cleaner (payant après 30j)
http://www.moosoft.com/products/cleaner/download/
puis refais un Hijackthis
a+