Virus msn seen this?? ^^ http://2short.net/ph

Bonjour,

j'ai recu ce virus hier via msn et je sais pas l'enlever !!"seen this?? ^^ http://2short.net/photo2010-10-08c_jpg " please help meeee ! merciii
ca envoie ce message a tous mes contacts et les contaminent !

2 réponses

  • Votes
  • Date
  • Date décroissante
  1. Modérateur
    Salut,

    Passe un coup de USBFix : https://www.malekal.com/usbfix-supprimer-virus-usb/
    Poste les rapports ici;
    1. ComboFix 10-10-12.03 - steve 14/10/2010 15:08:01.1.2 - x86
      Microsoft Windows XP Professional 5.1.2600.3.1252.32.1033.18.1023.716 [GMT 2:00]
      Lancé depuis: C:\Documents and Settings\steve\My Documents\Téléchargements\ComboFix.exe
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\DOCUME~1\steve\LOCALS~1\Temp\install_flash_player.exe
      C:\WINDOWS\system32\sshnas21.dll

      .
      \\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
      .
      \\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
      .
      ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      -------\Legacy_SSHNAS
      -------\Service_SSHNAS

      ((((((((((((((((((((((((((((( Fichiers créés du 2010-09-14 au 2010-10-14 ))))))))))))))))))))))))))))))))))))
      .

      2010-10-14 12:28:37 . 2010-10-14 07:26:42 593920 ------w- C:\2 - winservice.exe.back
      2010-10-14 12:28:11 . 2010-07-18 01:48:30 35118 ------w- C:\1 - smss.exe.back
      2010-10-14 12:27:11 . 2010-05-07 20:28:26 83598 ------w- C:\0 - hx.exe.back
      2010-10-14 11:09:09 . 2010-10-14 11:09:20 -------- d-----w- C:\Documents and Settings\steve\Application Data\UseNeXT
      2010-10-14 11:09:01 . 2010-10-14 11:09:02 -------- d-----w- C:\Program Files\UseNeXT
      2010-10-14 08:40:39 . 2010-10-14 08:40:39 -------- d-----w- C:\Documents and Settings\steve\Local Settings\Application Data\Mozilla
      2010-10-14 08:00:47 . 2010-10-14 08:00:47 -------- d-----w- C:\WINDOWS\system32\wbem\Repository
      2010-10-14 08:00:08 . 2010-10-14 08:00:08 -------- d-sh--r- C:\Documents and Settings\steve\Application Data\C-76947-8457-2745
      2010-10-14 07:26:58 . 2010-10-14 07:26:50 196608 ----a-w- C:\WINDOWS\Tvycea.exe
      2010-10-13 21:50:49 . 2010-10-13 21:50:49 -------- d-----w- C:\Program Files\AxBx
      2010-10-08 16:53:49 . 2010-10-08 16:53:49 -------- d-----w- C:\Program Files\iPod
      2010-10-08 16:53:38 . 2010-10-08 16:54:26 -------- d-----w- C:\Program Files\iTunes
      2010-10-08 16:51:00 . 2010-10-08 16:51:00 159744 ----a-w- C:\Program Files\Internet Explorer\PLUGINS\npqtplugin7.dll
      2010-10-08 16:51:00 . 2010-10-08 16:51:00 159744 ----a-w- C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
      2010-10-08 16:51:00 . 2010-10-08 16:51:00 159744 ----a-w- C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
      2010-10-08 16:51:00 . 2010-10-08 16:51:00 159744 ----a-w- C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
      2010-10-08 16:51:00 . 2010-10-08 16:51:00 159744 ----a-w- C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
      2010-10-08 16:51:00 . 2010-10-08 16:50:59 159744 ----a-w- C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
      2010-10-08 16:51:00 . 2010-10-08 16:50:59 159744 ----a-w- C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
      2010-10-08 16:50:37 . 2010-10-08 16:50:59 -------- d-----w- C:\Program Files\QuickTime
      2010-10-04 14:23:57 . 2010-10-04 14:23:57 -------- d-----w- C:\Documents and Settings\steve\Application Data\AVS4YOU
      2010-10-03 16:03:21 . 2010-09-15 10:09:24 10833920 ----a-w- C:\WINDOWS\system32\libmfxsw32.dll
      2010-10-03 16:03:20 . 2010-09-15 10:09:28 10915840 ----a-w- C:\WINDOWS\system32\libmfxhw32.dll
      2010-10-03 16:03:14 . 2010-10-03 16:04:09 -------- d-----w- C:\Program Files\Common Files\AVSMedia
      2010-10-03 16:02:57 . 2010-10-03 16:02:57 -------- d-----w- C:\WINDOWS\system32\drivers\umdf
      2010-10-03 16:00:14 . 2010-10-03 16:00:14 -------- d-----w- C:\WINDOWS\SxsCaPendDel
      2010-10-03 15:57:09 . 2010-10-04 14:23:55 -------- d-----w- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVS4YOU
      2010-10-03 15:57:09 . 2010-10-03 16:04:15 -------- d-----w- C:\Program Files\AVS4YOU
      2010-10-03 15:57:09 . 2010-09-15 10:10:20 1700352 ----a-w- C:\WINDOWS\system32\GdiPlus.dll
      2010-10-03 15:57:09 . 2010-09-15 10:10:18 24576 ----a-w- C:\WINDOWS\system32\msxml3a.dll
      2010-09-17 15:44:27 . 2010-09-17 15:44:28 -------- d-----w- C:\Program Files\Bonjour

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .

      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 20:12:52 3872080]
      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-19 03:17:47 39408]
      "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2010-01-20 18:30:21 16384]
      "WindowsDriverControl"="C:\Documents and Settings\steve\Application Data\C-76947-8457-2745\winmsngrn.exe" [2010-10-13 20:46:10 233472]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 21:13:34 61440]
      "RTHDCPL"="RTHDCPL.EXE" [2005-06-29 21:25:30 14720000]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2010-01-19 03:17:07 149280]
      "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-07-01 04:56:34 188416]
      "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-07-01 05:00:24 65536]
      "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2010-09-08 09:17:42 421888]
      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2010-09-24 00:10:52 421160]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-11-30 13:26:20 15360]

      C:\Documents and Settings\buzz\Menu D'marrer\Programmes\D'marrage\
      Notification de cadeaux MSN.lnk - C:\Documents and Settings\steve\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2010-8-26 135680]

      C:\Documents and Settings\steve\Start Menu\Programs\Startup\
      Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-19 479232]
      Notification de cadeaux MSN.lnk - C:\Documents and Settings\steve\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2010-8-26 135680]

      C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
      Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2010-1-20 169472]
      McAfee Security Scan.lnk - C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
      SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
      "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
      "C:\\Program Files\\Java\\jre6\\bin\\java.exe"=
      "C:\\Program Files\\Mirc\\mirc.exe"=
      "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
      "C:\\Program Files\\iTunes\\iTunes.exe"=
      "C:\\Documents and Settings\\steve\\Application Data\\C-76947-8457-2745\\winmsngrn.exe"=
      "C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
      "C:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
      "C:\\Program Files\\Messenger\\msmsgs.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

      S2 gupdate1ca98b725125138;Service Google Update (gupdate1ca98b725125138);C:\Program Files\Google\Update\GoogleUpdate.exe [19/01/2010 5:26:09 133104]
      S3 maconfservice;Ma-Config Service;"C:\Program Files\ma-config.com\maconfservice.exe" --> C:\Program Files\ma-config.com\maconfservice.exe [?]
      .
      Contenu du dossier 'Tâches planifiées'

      2010-10-08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
      - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50:20 . 2009-10-22 09:50:20]

      2010-10-14 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
      - C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-19 03:26:09 . 2010-01-19 03:26:07]

      2010-10-14 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
      - C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-19 03:26:09 . 2010-01-19 03:26:07]

      2010-10-14 C:\WINDOWS\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
      - C:\WINDOWS\Tvycea.exe [2010-10-14 07:26:58 . 2010-10-14 07:26:50]
      .
      .
      ------- Examen supplémentaire -------
      .
      uStart Page = hxxp://www.google.com/
      uInternet Settings,ProxyOverride = localhost;*.local
      IE: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
      DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://www.visiogood.com/jalss/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe
      FF - ProfilePath - C:\Documents and Settings\steve\Application Data\Mozilla\Firefox\Profiles\jpe8b3w3.default\
      FF - plugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
      FF - plugin: C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
      FF - plugin: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
      FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

      ---- PARAMETRES FIREFOX ----
      C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
      C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
      .
      - - - - ORPHELINS SUPPRIMES - - - -

      URLSearchHooks-{364d4e0c-543f-4b85-abe3-19551139da4f} - C:\Program Files\Softonic_France\tbSoft.dll
      BHO-{364d4e0c-543f-4b85-abe3-19551139da4f} - C:\Program Files\Softonic_France\tbSoft.dll
      Toolbar-{364d4e0c-543f-4b85-abe3-19551139da4f} - C:\Program Files\Softonic_France\tbSoft.dll
      AddRemove-Softonic_France Toolbar - C:\PROGRA~1\SOFTON~1\UNWISE.EXE
    2. voici le rapport avec combofix mais le virus est toujours la !! merci de m'aider monsieur !!
    3. Modérateur
      Je pense pas avoir demandé de rapport Combofix.
    4. oui je sais mais avec le usbfix ca fonctionne pas !! :))))
  2. Modérateur
    * Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.
    (Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

    * Lance OTL
    * Sous Peronnalisation, copie-colle ce qu'il y a dans le cadre ci-dessous :
    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    CREATERESTOREPOINT

    * Clique sur le bouton Quick Scan.
    * Quand le scan est fini, utilise le site http://www.cijoint.fr/ pour me donner les deux rapports : OTL.Txt et Extras.Txt.