la totale Fermé

Question

bonsoir j'ai limpression que mon pc a chopé la totale virus trojan spyware...Je fais donc apel a ce forum qui m'a déjà rendu bien des services pour cela jai fais un scan hijackthis le voici  et merci Logfile of HijackThis v1.99.1Scan saved at 20:08:37, on 03/04/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeC:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings
icooosla\Mes documents\hijackthis_199\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSLR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF2 - REG:system.ini: Shell=explorer.exe                                                                                                    "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.exe"O2 - BHO: Glitch - {C3F699FD-5F86-451B-8150-81979857047E} - C:\WINDOWS\system32
sw2E.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeO4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /trayO4 - HKLM\..\Run: [MagicKeyboard] C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exeO4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - HKLM\..\Run: [tetriz3] C:\WINDOWS\system32	etriz3.exeO4 - HKLM\..\RunServices: [tetriz3] C:\WINDOWS\system32	etriz3.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Zilla Popup Killer] C:\Program Files\Zilla Popup Killer\ZillaPop.exeO4 - HKCU\..\Run: [tetriz3] C:\WINDOWS\system32	etriz3.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NPADEMO.lnk = C:\Program Files\Net Pro Anti Popup\NPADEMO.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO10 - Unknown file in Winsock LSP: c:\program files	rackzapper.com	z spyware-remover\apptoport.dllO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dllO23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

bernie61 · Answer

Hello
commence par applique la procédure lspfix et celle de adaware
http://users.skynet.be/BernieClub/index.html#lspexplorer

installes un VRAI firewall
http://users.skynet.be/BernieClub/index.html#tutor

puis refais un hijack
a+

nicosla · Answer

euh j'ai DL lsp explorer mais je le vois nulle part apart le fichier .exe

bernie61 · Answer

reje te comprend pas, c'est un fichier ZIP qu il faut décomprimera+

nicosla · Answer

ben je telecharge lspexplorer comme indiqué je linstalle et je n'ai aucun raccourci pour le lancer je nai que le linstal l spexplorer.exe
et tu peux me donné le lien direct sur un firewall car je sais pa quoi choisir merci

bernie61 · Answer

re
relis la procédure le fichier est à placer dans le répertoire de Lavasoft AdAware et tu le lances par adaware puis AdsON (à gauche de la fen^tre adaware) puis tu vois dans une liste lsp explorer , tu vas dessus puis en dessous cliq RUN
a+

La totale

5 réponses

Discussions similaires

Newsletters