Gros virus Fermé

Question

Bonjour,

J'ai des fenêtres publicitaires qui s'affiche H24.... j'en peux plus !
Merciii beacoup à la personne qui m'aidera, bisouxx

Voici un rapport HJT :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:13:16, on 02/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\msb.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\DOCUME~1\Salim\LOCALS~1\Temp\Hjl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aliceadsl.fr/
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [67BD16] C:\WINDOWS\system32\825606\67BD16.EXE
O4 - HKCU\..\Run: [TOY5KNQ8OC] C:\DOCUME~1\Salim\LOCALS~1\Temp\Hjl.exe
O4 - HKCU\..\Run: [ROUA3O12PW] C:\WINDOWS\msb.exe
O4 - S-1-5-18 Startup: 67BD16.lnk = C:\WINDOWS\system32\825606\67BD16.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: Groom.lnk = C:\Program Files\Toox\Groom\Groom.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: 67BD16.lnk = C:\WINDOWS\system32\825606\67BD16.EXE (User 'Default user')
O4 - .DEFAULT Startup: Groom.lnk = C:\Program Files\Toox\Groom\Groom.exe (User 'Default user')
O4 - Startup: 67BD16.lnk = C:\WINDOWS\system32\825606\67BD16.EXE
O4 - Startup: Groom.lnk = C:\Program Files\Toox\Groom\Groom.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Groom - {66F83792-DAE1-4823-8F20-ADA94B33A4FF} - C:\Program Files\Toox\Groom\Groom.exe (HKCU)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

kotor71 · Answer

tu veut qu'on t'aide en fessant quoi ?

hacker13 · Answer

lol en fessant quoi ces a nous de lui dire ce qu'il faut qu'il fasse

Brenda · Answer

Voici un log combofix:

ComboFix 10-03-01.04 - Salim 02/03/2010  18:28:48.1.1 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.1014.641 [GMT 1:00]
Lancé depuis: c:\documents and settings\Salim\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Salim\LOCALS~1\Temp\E_N4
c:\docume~1\Salim\LOCALS~1\Temp\E_N4\dp1.fne
c:\docume~1\Salim\LOCALS~1\Temp\E_N4\internet.fne
c:\windows\AegisP.inf
c:\windows\msa.exe
c:\windows\msb.exe
c:\windows\system32\825606
c:\windows\system32\sshnas21.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-02-02 au 2010-03-02  ))))))))))))))))))))))))))))))))))))
.

2010-03-02 12:39 . 2010-03-02 12:39 -------- d-----w- c:\program files\Fichiers communs\Borland Shared
2010-03-02 12:39 . 1999-01-20 04:01 210032 ----a-w- c:\windows\system32\DBCLIENT.DLL
2010-02-26 17:06 . 2010-02-26 17:06 -------- d-----w- c:\documents and settings\Salim\Application Data\Malwarebytes
2010-02-26 17:06 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-26 17:06 . 2010-02-26 17:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-26 17:06 . 2010-02-26 17:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-26 17:06 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-26 10:02 . 2010-03-02 17:17 -------- d--h--w- c:\windows\system32\8E0FE5
2010-02-26 10:02 . 2010-02-26 16:39 -------- d--h--w- c:\windows\system32\F7F2CF
2010-02-26 10:02 . 2010-02-26 10:17 -------- d--h--w- c:\windows\system32\703F4F

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-23 18:20 . 2009-06-17 23:59 -------- d-----w- c:\program files\Toox
2010-01-18 21:17 . 2009-06-18 02:47 -------- d-----w- c:\documents and settings\Salim\Application Data\Skype
2009-12-31 16:50 . 2008-04-13 10:15 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-23 17:08 . 2009-06-17 23:04 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-21 19:07 . 2008-04-13 17:33 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-21 09:11 . 2009-06-17 20:36 27200 ----a-w- c:\documents and settings\Salim\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-17 07:41 . 2009-06-17 19:39 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2008-04-13 17:33 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 17:40 . 2002-09-07 00:00 88522 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-09 17:40 . 2002-09-07 00:00 518200 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-09 10:09 . 2008-04-13 19:07 2068096 ----a-w- c:\windows\system32
tkrnlpa.exe
2009-12-09 10:09 . 2008-04-13 17:08 2191232 ----a-w- c:\windows\system32
toskrnl.exe
2009-12-04 18:22 . 2008-04-13 10:17 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.

Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

c:\documents and settings\Salim\Menu D‚marrer\Programmes\D‚marrage\
Groom.lnk - c:\program files\Toox\Groom\Groom.exe [2009-5-28 1542616]

c:\documents and settings\Salim\Menu D‚marrer\Programmes\D‚marrage\
Groom.lnk - c:\program files\Toox\Groom\Groom.exe [2009-5-28 1542616]

c:\documents and settings\Salim\Menu D‚marrer\Programmes\D‚marrage\
Groom.lnk - c:\program files\Toox\Groom\Groom.exe [2009-5-28 1542616]

c:\documents and settings\Salim\Menu D‚marrer\Programmes\D‚marrage\
Groom.lnk - c:\program files\Toox\Groom\Groom.exe [2009-5-28 1542616]

c:\documents and settings\Salim\Menu D‚marrer\Programmes\D‚marrage\
Groom.lnk - c:\program files\Toox\Groom\Groom.exe [2009-5-28 1542616]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 11 (0xb)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"%windir%\system32\sessmgr.exe"=
"c:\Documents and Settings\Salim\temp\TeamViewer\Version4\TeamViewer.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\ACSPMonitor\ASMonitor.exe"=
"c:\Program Files\Java\jre6\bin\javaw.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [23/12/2009 18:02 108289]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [17/06/2009 22:36 1684736]
.
Contenu du dossier 'Tâches planifiées'

2010-02-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-03-02 c:\windows\Tasks\User_Feed_Synchronization-{6D29AD96-B48E-479D-A161-55848C8D847A}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.aliceadsl.fr/
.



catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-02 18:31
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0


.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1292428093-515967899-1177238915-1003\Software\SecuROM\License information*]
"datasecu"=hex:ce,3f,38,cf,99,9a,4f,26,2c,aa,c6,8a,61,f2,e7,99,91,ab,e9,ed,65,
   7a,7c,bd,e0,c2,16,be,f3,fc,85,03,38,c8,69,fd,32,b3,30,25,07,3f,c3,fa,10,9a,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32
etprovcredman.dll
.
Heure de fin: 2010-03-02  18:33:06
ComboFix-quarantined-files.txt  2010-03-02 17:33

Avant-CF: 81 519 177 728 octets libres
Après-CF: 81 571 475 456 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 4F6559C95E920DA215980355B9A48252

Gros virus

3 réponses

Discussions similaires