virus aidez moi

Question

bonjour je me suis choper un virus: il n'arrete pas de travailler et écris ds la memeoir continuellement jusqu'a ce qu'elle soit pleine, qd elle est pleine il me dit memoire insuffisante... (quand j'essaye d'ouvrir un fichier)   j'ai un antivirus : avg v.7 ...j'ai utilisé HijackThis :Logfile of HijackThis v1.99.1Scan saved at 06:17:35, on 25/10/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\Spyware Doctor\sdhelp.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\RunDll32.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\pspvideo9\pspVideo9.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\Program Files\iPod\bin\iPodService.exeC:\PROGRA~1\Grisoft\AVG7\avgemc.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\WINDOWS\etb\pokapoka78.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeC:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.the818search-co.com/sp2.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.the818search-co.com/sp2.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.the818search-co.com/sp2.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ebay.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freebox.free.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.the818search-co.com/sp2.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO1 - Hosts: 195.158.172.121 www.file-webber.deO1 - Hosts: 195.158.172.121 file-webber.deO1 - Hosts: 195.158.172.121 www-google.aeO1 - Hosts: 195.158.172.121 www-google.asO1 - Hosts: 195.158.172.121 www-google.atO1 - Hosts: 195.158.172.121 www-google.auO1 - Hosts: 195.158.172.121 www-google.biO1 - Hosts: 195.158.172.121 www-google.brO1 - Hosts: 195.158.172.121 www-google.caO1 - Hosts: 195.158.172.121 www-google.ccO1 - Hosts: 195.158.172.121 www-google.cdO1 - Hosts: 195.158.172.121 www-google.cgO1 - Hosts: 195.158.172.121 www-google.chO1 - Hosts: 195.158.172.121 www-google.clO1 - Hosts: 195.158.172.121 www-google.co.crO1 - Hosts: 195.158.172.121 www-google.co.ggO1 - Hosts: 195.158.172.121 www-google.co.huO1 - Hosts: 195.158.172.121 www-google.co.ilO1 - Hosts: 195.158.172.121 www-google.co.inO1 - Hosts: 195.158.172.121 www-google.co.jeO1 - Hosts: 195.158.172.121 www-google.co.jpO1 - Hosts: 195.158.172.121 www-google.co.krO1 - Hosts: 195.158.172.121 www-google.co.lsO1 - Hosts: 195.158.172.121 www-google.co.nzO1 - Hosts: 195.158.172.121 www-google.comO1 - Hosts: 195.158.172.121 www-google.com.aeO1 - Hosts: 195.158.172.121 www-google.com.auO1 - Hosts: 195.158.172.121 www-google.com.caO1 - Hosts: 195.158.172.121 www-google.com.doO1 - Hosts: 195.158.172.121 www-google.com.fjO1 - Hosts: 195.158.172.121 www-google.com.grO1 - Hosts: 195.158.172.121 www-google.com.lyO1 - Hosts: 195.158.172.121 www-google.com.mtO1 - Hosts: 195.158.172.121 www-google.com.myO1 - Hosts: 195.158.172.121 www-google.com.nfO1 - Hosts: 195.158.172.121 www-google.com.niO1 - Hosts: 195.158.172.121 www-google.com.paO1 - Hosts: 195.158.172.121 www-google.com.peO1 - Hosts: 195.158.172.121 www-google.com.pkO1 - Hosts: 195.158.172.121 www-google.com.prO1 - Hosts: 195.158.172.121 www-google.com.pyO1 - Hosts: 195.158.172.121 www-google.com.ruO1 - Hosts: 195.158.172.121 www-google.com.sgO1 - Hosts: 195.158.172.121 www-google.com.svO1 - Hosts: 195.158.172.121 www-google.com.trO1 - Hosts: 195.158.172.121 www-google.com.twO1 - Hosts: 195.158.172.121 www-google.com.vcO1 - Hosts: 195.158.172.121 www-google.com.vnO1 - Hosts: 195.158.172.121 www-google.crO1 - Hosts: 195.158.172.121 www-google.deO1 - Hosts: 195.158.172.121 www-google.djO1 - Hosts: 195.158.172.121 www-google.doO1 - Hosts: 195.158.172.121 www-google.esO1 - Hosts: 195.158.172.121 www-google.fjO1 - Hosts: 195.158.172.121 www-google.frO1 - Hosts: 195.158.172.121 www-google.ggO1 - Hosts: 195.158.172.121 www-google.glO1 - Hosts: 195.158.172.121 www-google.gmO1 - Hosts: 195.158.172.121 www-google.grO1 - Hosts: 195.158.172.121 www-google.hnO1 - Hosts: 195.158.172.121 www-google.huO1 - Hosts: 195.158.172.121 www-google.ieO1 - Hosts: 195.158.172.121 www-google.ilO1 - Hosts: 195.158.172.121 www-google.inO1 - Hosts: 195.158.172.121 www-google.itO1 - Hosts: 195.158.172.121 www-google.jeO1 - Hosts: 195.158.172.121 www-google.jpO1 - Hosts: 195.158.172.121 www-google.krO1 - Hosts: 195.158.172.121 www-google.kzO1 - Hosts: 195.158.172.121 www-google.lsO1 - Hosts: 195.158.172.121 www-google.ltO1 - Hosts: 195.158.172.121 www-google.luO1 - Hosts: 195.158.172.121 www-google.lvO1 - Hosts: 195.158.172.121 www-google.lyO1 - Hosts: 195.158.172.121 www-google.mtO1 - Hosts: 195.158.172.121 www-google.muO1 - Hosts: 195.158.172.121 www-google.mwO1 - Hosts: 195.158.172.121 www-google.myO1 - Hosts: 195.158.172.121 www-google.nfO1 - Hosts: 195.158.172.121 www-google.niO1 - Hosts: 195.158.172.121 www-google.nlO1 - Hosts: 195.158.172.121 www-google.nzO1 - Hosts: 195.158.172.121 www-google.paO1 - Hosts: 195.158.172.121 www-google.peO1 - Hosts: 195.158.172.121 www-google.pkO1 - Hosts: 195.158.172.121 www-google.plO1 - Hosts: 195.158.172.121 www-google.pnO1 - Hosts: 195.158.172.121 www-google.prO1 - Hosts: 195.158.172.121 www-google.ptO1 - Hosts: 195.158.172.121 www-google.pyO1 - Hosts: 195.158.172.121 www-google.ruO1 - Hosts: 195.158.172.121 www-google.rwO1 - Hosts: 195.158.172.121 www-google.seO1 - Hosts: 195.158.172.121 www-google.sgO1 - Hosts: 195.158.172.121 www-google.shO1 - Hosts: 195.158.172.121 www-google.skO1 - Hosts: 195.158.172.121 www-google.smO1 - Hosts: 195.158.172.121 www-google.svO1 - Hosts: 195.158.172.121 www-google.tdO1 - Hosts: 195.158.172.121 www-google.trO1 - Hosts: 195.158.172.121 www-google.twO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [Xnggqomd] C:\Program Files\Zmszu\Livuzw.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeO4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdiscO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_6_0\Ghost (file missing)O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_6_0\Ghost (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/bridge-c337.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112199319953O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O17 - HKLM\System\CS1\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O21 - SSODL: System - {DADB1AE5-C74E-4EF7-A62E-062CF9CE382D} - mcsys.dll (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exeje ne sais pas quoi faire...aidez moi merci

bernie61 · Answer

salutlà antivirus AVAST en conflit avec AVG, désinstalle AVAST ou arrête le résident de AVG (l'antivirus pas ton firewall AVG)où en sont tes problèmesrefais un Hijackthisa+

bernie61 · Answer

re
ensuite
0. Installe ce nettoyeur CCLEANER http://www.ccleaner.com/ ou lien direct là http://www.filehippo.com/download_ccleaner.html (la flèche)
Tutorial là http://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
ensuite
*Configure ton ordi pour tous scan à exécuter complétement, il faut pouvoir scanner tous les dossiers caché et système donc faire :
Démarrer/PanneauConfiguration/OptionsDossiers /ongletAffichage et là cocher les lignes
- afficher les fichiers et dossier cachés
- afficher contenu dossier système
décocher
- masquer fichiers protégés du dossier système
Puis cliquer APPLIQUER à TOUS les Dossiers

1. Tu connais ça ? non, alors vérifie (cliq droit souris/propriété) si inconnu ZIP compresse le fichier et efface le .EXE (sinon à vérifier là http://virusscan.jotti.org/ fichier par fichier Parcourir puis SEND lance ce multiple scanneur antivirus)

2. Relances Hijackthis et coche (puis FIX)
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.the818search-co.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.the818search-co.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.the818search-co.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.the818search-co.com/sp2.php
O1 HOST >>> cocher TOUTES les lignes
O4 - HKLM\..\Run: [Xnggqomd] C:\Program Files\Zmszu\Livuzw.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_6_0\Ghost (file missing) > si tu n’utilise pas Ghost
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_6_0\Ghost (file missing) > si tu n’utilise pas Ghost
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/bridge-c337.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112199319953
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab

3. Effacer ces programmes .EXE ( et à la fin vider la corbeille)
C:\Program Files\Zmszu\Livuzw.exe

5. vider les répertoires temps et la corbeille, en lançant Ccleaner
Refais un hijackthis de contrôle
a+

bernie61 · Answer

re
si tu as encore des problèmes applique ceci
1. Télécharger SmitfraudFix du site de S!Ri sur le bureau par exemple:
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
2. désactiver l’antivirus (car est détecté faussement comme virus malware)
3. décomprimer SmitfraudFix
4. Lancer SmitfraudFix, et choisir l’option 1 ; copier le rapport ici ;
5. Redémarrer l’ordi en mode sans échec ;
6. vérifier que l’antivirus est toujours désactivé
7. Relancer SmitfraudFix à nouveau mais choisir l’option 2 et accepter les demandes, copier le log ;
8. Redémarrer l’ordi en mode normal,
9. vérifier le redémarrage de l’antivirus si cela n’est pas automatique et refaire un Hijackthis
http://www.merijn.org/files/hijackthis.zip
et copier/coller le rapport ici avec le 2ème rapport de smitfraud;
a+

zoid · Answer

bon j'ai désinstaller avastvoila le nouveau rapportLogfile of HijackThis v1.99.1Scan saved at 08:38:01, on 25/10/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\Spyware Doctor\sdhelp.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\RunDll32.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\pspvideo9\pspVideo9.exeC:\Program Files\iPod\bin\iPodService.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\PROGRA~1\Grisoft\AVG7\avgemc.exeC:\WINDOWS\etb\pokapoka78.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeC:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Internet Explorer\iexplore.exeC:\hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.clicktomakeasearch.com/sp2.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.clicktomakeasearch.com/sp2.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.clicktomakeasearch.com/sp2.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ebay.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freebox.free.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.clicktomakeasearch.com/sp2.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [Xnggqomd] C:\Program Files\Zmszu\Livuzw.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeO4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdiscO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_6_0\Ghost (file missing)O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_6_0\Ghost (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/bridge-c337.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112199319953O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O17 - HKLM\System\CS1\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O21 - SSODL: System - {DADB1AE5-C74E-4EF7-A62E-062CF9CE382D} - mcsys.dll (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exeje vais de suite continuer a suivre tes instruction.. merciau fait qd je redemarre mon ordi j'ai un pb avec WZCEGWIZ.EXE et HIMRCL32.EXEje te tiens au courant

zoid · Answer

bon la j'ai fini ton deuxieme message 1,2,3,5...voila le rapportLogfile of HijackThis v1.99.1Scan saved at 08:48:39, on 25/10/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\Spyware Doctor\sdhelp.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\RunDll32.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\pspvideo9\pspVideo9.exeC:\Program Files\iPod\bin\iPodService.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\PROGRA~1\Grisoft\AVG7\avgemc.exeC:\WINDOWS\etb\pokapoka78.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeC:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Internet Explorer\iexplore.exeC:\hijackthis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ebay.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freebox.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeO4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdiscO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/O17 - HKLM\System\CCS\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O17 - HKLM\System\CS1\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O21 - SSODL: System - {DADB1AE5-C74E-4EF7-A62E-062CF9CE382D} - mcsys.dll (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exeje vais redemarrer mon ordis si il y a encore des pb je ferais le 3 mess @ tout de suiiiiiiiiiiiiiiiiiiiiiiiiiiiite

zoid · Answer

voila le rapport de smitfraudfix

SmitFraudFix v1.91

Rapport fait à 8:56:58,04 le 25/10/2005
Executé à partir de C:\s\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\zoid\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\zoid\Bureau

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

C:\Program Files\Daily Weather Forecast\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

zoid · Answer

voila le 2eme rapportSmitFraudFix v1.91Rapport fait à  9:00:26,65 le 25/10/2005Executé à partir de C:\s\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\Program Files\Daily Weather Forecast\ supprimé »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapportet le rapport de hijakthisLogfile of HijackThis v1.99.1Scan saved at 09:06:33, on 25/10/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\Spyware Doctor\sdhelp.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\RunDll32.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\pspvideo9\pspVideo9.exeC:\Program Files\iPod\bin\iPodService.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\PROGRA~1\Grisoft\AVG7\avgemc.exeC:\WINDOWS\etb\pokapoka78.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeC:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\hijackthis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freebox.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeO4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdiscO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dllO14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/O17 - HKLM\System\CCS\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O17 - HKLM\System\CS1\Services\Tcpip\..\{04B951C7-7786-4A1B-B835-052FFFD0E10C}: NameServer = 217.27.32.5,213.228.0.168O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O21 - SSODL: System - {DADB1AE5-C74E-4EF7-A62E-062CF9CE382D} - mcsys.dll (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exemais mon probleme est tjs présent  snifffffffffffffffffffffque faire?

zoid · Answer

quand je fait ctrl alt sup, gestionnaire des taches de windows, que je regarde le processus... en bas la charge dédiée n'arrete pas d'augmenter 484mo/...488....492... HAAA..
(le probleme viendrai t'il de la?)

zoid · Answer

je n'ai tjs pas résolu le pb snifffffffffffffffffff

Virus aidez moi

9 réponses

Discussions similaires

Newsletters