(hijackthis) cheval de troie/trojan win 32

Question

rebonjourdésolé j'ai oublié de mettre le rapportencore merciLogfile of HijackThis v1.99.1Scan saved at 16:59:24, on 20/12/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\Explorer.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exec:\progra~1\intern~1\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\WINDOWS\system32\94.tmpc:\docume~1\jean-b~1\applic~1
ewchi~1\Dentwavewindow.exec:\docume~1\jean-b~1\applic~1
ewchi~1\Dentwavewindow.exeC:\WINDOWS\System32\msiexec.exeC:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX09.063\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.psrvnonrufbefmlqtvmmo.net/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeWt5QKqMb/lsZIg4_W7nt2/.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.oreka.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF2 - REG:system.ini: Shell=Explorer.exe smsse.exeF2 - REG:system.ini: UserInit=userinit.exe,xpjava.exeO1 - Hosts: 64.233.167.104 www.symantec.comO1 - Hosts: 64.233.167.104 www.sophos.comO1 - Hosts: 64.233.167.104 www.mcafee.comO1 - Hosts: 64.233.167.104 www.viruslist.comO1 - Hosts: 64.233.167.104 www.f-secure.comO1 - Hosts: 64.233.167.104 www.avp.comO1 - Hosts: 64.233.167.104 www.kaspersky.comO1 - Hosts: 64.233.167.104 www.networkassociates.comO1 - Hosts: 64.233.167.104 www.ca.comO1 - Hosts: 64.233.167.104 www.my-etrust.comO1 - Hosts: 64.233.167.104 www.nai.comO1 - Hosts: 64.233.167.104 www.trendmicro.comO1 - Hosts: 64.233.167.104 www.grisoft.comO1 - Hosts: 64.233.167.104 securityresponse.symantec.comO1 - Hosts: 64.233.167.104 symantec.comO1 - Hosts: 64.233.167.104 sophos.comO1 - Hosts: 64.233.167.104 mcafee.comO1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.comO1 - Hosts: 64.233.167.104 viruslist.comO1 - Hosts: 64.233.167.104 f-secure.comO1 - Hosts: 64.233.167.104 kaspersky.comO1 - Hosts: 64.233.167.104 kaspersky-labs.comO1 - Hosts: 64.233.167.104 avp.comO1 - Hosts: 64.233.167.104 networkassociates.comO1 - Hosts: 64.233.167.104 ca.comO1 - Hosts: 64.233.167.104 mast.mcafee.comO1 - Hosts: 64.233.167.104 my-etrust.comO1 - Hosts: 64.233.167.104 download.mcafee.comO1 - Hosts: 64.233.167.104 dispatch.mcafee.comO1 - Hosts: 64.233.167.104 secure.nai.comO1 - Hosts: 64.233.167.104 nai.comO1 - Hosts: 64.233.167.104 update.symantec.comO1 - Hosts: 64.233.167.104 updates.symantec.comO1 - Hosts: 64.233.167.104 us.mcafee.comO1 - Hosts: 64.233.167.104 liveupdate.symantec.comO1 - Hosts: 64.233.167.104 customer.symantec.comO1 - Hosts: 64.233.167.104 rads.mcafee.comO1 - Hosts: 64.233.167.104 trendmicro.comO1 - Hosts: 64.233.167.104 grisoft.comO1 - Hosts: 64.233.167.104 sandbox.norman.noO1 - Hosts: 64.233.167.104 www.pandasoftware.comO1 - Hosts: 64.233.167.104 uk.trendmicro-europe.comO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {77B37C7B-057E-F3B6-8E23-EA9EDC2D0160} - C:\DOCUME~1\JEAN-B~1\APPLIC~1\MULTIO~1\deafface.exeO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\Run: [runs] run.exeO4 - HKLM\..\Run: [ATIUpdater] atiupdxx.exeO4 - HKLM\..\Run: [HPWebSync] WebSyncSvc.exeO4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\94.tmpO4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\RunServices: [runs] run.exeO4 - HKLM\..\RunServices: [ATIUpdater] atiupdxx.exeO4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\Run: [runs] run.exeO4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [ball first] C:\DOCUME~1\JEAN-B~1\APPLIC~1\NEWCHI~1\city bike htm.exeO4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO4 - Global Startup: Picture Package Menu.lnk = ?O4 - Global Startup: Picture Package VCD Maker.lnk = ?O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO14 - IERESET.INF: START_PAGE_URL=http://www.oreka.comO15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet ZoneO16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exeO16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.tbcode.com/ist/softwares/v4.0/0006_regular.cabO16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exeO23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeO23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeO23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32pcsvc.exe

ben13010 · Answer

ok

fixe ca et supprime les fichier en gras

( tu ouvre hijackthis et tu clik sur la 2eme case
met une crois en face des lignes indiquée et clik a la fin sur fix checked )

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.psrvnonrufbefmlqtvmmo.net/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeWt5QKqMb/lsZIg4_W7nt2/.ht

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.oreka.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm

F2 - REG:system.ini: Shell=Explorer.exe smsse.exe
F2 - REG:system.ini: UserInit=userinit.exe,xpjava.exe
O1 - Hosts: 64.233.167.104 www.symantec.com
O1 - Hosts: 64.233.167.104 www.sophos.com
O1 - Hosts: 64.233.167.104 www.mcafee.com
O1 - Hosts: 64.233.167.104 www.viruslist.com
O1 - Hosts: 64.233.167.104 www.f-secure.com
O1 - Hosts: 64.233.167.104 www.avp.com
O1 - Hosts: 64.233.167.104 www.kaspersky.com
O1 - Hosts: 64.233.167.104 www.networkassociates.com
O1 - Hosts: 64.233.167.104 www.ca.com
O1 - Hosts: 64.233.167.104 www.my-etrust.com
O1 - Hosts: 64.233.167.104 www.nai.com
O1 - Hosts: 64.233.167.104 www.trendmicro.com
O1 - Hosts: 64.233.167.104 www.grisoft.com
O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
O1 - Hosts: 64.233.167.104 symantec.com
O1 - Hosts: 64.233.167.104 sophos.com
O1 - Hosts: 64.233.167.104 mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
O1 - Hosts: 64.233.167.104 viruslist.com
O1 - Hosts: 64.233.167.104 f-secure.com
O1 - Hosts: 64.233.167.104 kaspersky.com
O1 - Hosts: 64.233.167.104 kaspersky-labs.com
O1 - Hosts: 64.233.167.104 avp.com
O1 - Hosts: 64.233.167.104 networkassociates.com
O1 - Hosts: 64.233.167.104 ca.com
O1 - Hosts: 64.233.167.104 mast.mcafee.com
O1 - Hosts: 64.233.167.104 my-etrust.com
O1 - Hosts: 64.233.167.104 download.mcafee.com
O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
O1 - Hosts: 64.233.167.104 secure.nai.com
O1 - Hosts: 64.233.167.104 nai.com
O1 - Hosts: 64.233.167.104 update.symantec.com
O1 - Hosts: 64.233.167.104 updates.symantec.com
O1 - Hosts: 64.233.167.104 us.mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
O1 - Hosts: 64.233.167.104 customer.symantec.com
O1 - Hosts: 64.233.167.104 rads.mcafee.com
O1 - Hosts: 64.233.167.104 trendmicro.com
O1 - Hosts: 64.233.167.104 grisoft.com
O1 - Hosts: 64.233.167.104 sandbox.norman.no
O1 - Hosts: 64.233.167.104 www.pandasoftware.com
O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com

2 - BHO: (no name) - {77B37C7B-057E-F3B6-8E23-EA9EDC2D0160} - C:\DOCUME~1\JEAN-B~1\APPLIC~1\MULTIO~1\deafface.exe

O4 - HKLM\..\Run: [ATIUpdater] atiupdxx.exe

O4 - HKLM\..\Run: [HPWebSync] WebSyncSvc.exe
O4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\94.tmp

O4 - HKLM\..\RunServices: [runs] run.exe

O4 - HKLM\..\RunServices: [ATIUpdater] atiupdxx.exe

O4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exe

O4 - HKCU\..\Run: [ball first] C:\DOCUME~1\JEAN-B~1\APPLIC~1\NEWCHI~1\city bike htm.exe

tu as des malwares dans tes fichiers temporaires

efface les avec cleanup!

http://www.stevengould.org/software/cleanup/

touche pas la configuration de base

reposte ensuite

marie-claire · Answer

merci beaucoup pour votre aidej'ai fait ce que vous m'avez conseillévoici le nouveau résultat du scanLogfile of HijackThis v1.99.1Scan saved at 17:07:22, on 21/12/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\system32\9A.tmpC:\WINDOWS\Explorer.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\WINDOWS\System32\lexpps.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\WinRAR\WinRAR.exeC:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX00.688\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.cxdqwhlyntyrslnqnltbtcusx.com/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeXmhm/3C4D6bpIg4_W7nt2/.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\Run: [runs] run.exeO4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\94.tmpO4 - HKLM\..\Run: [Printer Spooler] C:\WINDOWS\system32\9A.tmpO4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\Run: [runs] run.exeO4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAjO4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO14 - IERESET.INF: START_PAGE_URL=http://www.oreka.comO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} (CInstall Class) - http://adserver.sharewareonline.com/adserver/Install.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exeO23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeO23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeO23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32pcsvc.exe (file missing)merci de votre aide

ben13010 · Answer

de rien mais c'est pas fini !!

des lignes apparaissent toujours

refixe les et efface les exe ou dll correspondants

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.cxdqwhlyntyrslnqnltbtcusx.com/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeXmhm/3C4D6bpIg4_W7nt2/.html

4 - HKLM\..\Run: [runs] run.exe

O4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exe
O4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exe

O4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exe

O4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAj

supprime manuellement les fichiers en gras sinon meme si tu les fixes , ils reapparaitront

si tu as des probleme pour les effacer fais ca

ouvrir Hijackthis là en bas droite CONFIG puis onglet MISCtools, là « Delete a file on reboot », cliq dessus et suivre chemin de fichier à effacer, il indique alors « voulez-vous redémarrer maintenant », cliq sur NON si d’autres fichiers sont à sélectionner et à nouveau « Delete a file on reboot » .. puis cliq OUI quand tous les fichiers sont sélectionnés

ils devraient etre effacé au redemmarage

reposte un rapport

fais ausi ca

Télécharge ceci:
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

Démarre en mode sans échec (tapoter sur F8 dés le demarrage de windows
Relance le programme Smitfraud,
Cette fois choisir l’option 2, répondre oui a tous ;
Sauvegarder le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

(hijackthis) cheval de troie/trojan win 32

3 réponses

Votre réponse

Discussions similaires

Newsletters