[trojan] infecté par WIN32:Dialer-527

Question

Bonjour Messieurs,j'ai ce fameux win32.dialer 527 j'ai assayé a2, avast, spybot,ad aware serien a faire.help SVPpuis je poster un log hijackTHis pour que vous voyez ça de plus  prés SVP

Regis59 · Answer

Salut ribery,Poste le sans problemea+

ribery · Answer

Messieurs,Donc après avoir:1. Fait bien les mises à jour2. Fait tous les scans avec ad-aware,spyboot,a23. Nettoyez la base de registre avec CCleaner4. Redémarrez le pc.5. Ouvrez juste les applications nécessairesPour une meilleure lecture du log d'Hijackthis le lancement s'effectue voici le resultat:Logfile of HijackThis v1.99.1Scan saved at 17:02:04, on 19/04/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ACS.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\ltmoh\Ltmoh.exeC:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Toshiba\Toshiba Applet	hotkey.exeC:\Program Files\TOSHIBA\Tvs\TvsTray.exeC:\WINDOWS\system32\TPSMain.exeC:\Program Files\TOSHIBA\ConfigFree\NDSTray.exeC:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exeC:\Program Files\TOSHIBA\Touch and Launch\PadExe.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Winamp\winampa.exeC:\Program Files\CyberLink\PowerDVD\PDVDServ.exeC:\Program Files\SlySoft\CloneCD\CloneCDTray.exeC:\Program Files\SlySoft\AnyDVD\AnyDVD.exeC:\WINDOWS\system32\TPSBattM.exeC:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exeC:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxWatchTray.exeC:\Program Files\Agnitum\Outpost Firewall\outpost.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxMediaDB.exeC:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxWatch.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exeC:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeC:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exeC:\Program Files\BinarySense\HDDlife\HDDlifePro.exeC:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\CPSHelpRunner.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\system32\wbem\wmiapsrv.exeC:\Program Files\hijackthis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO3 - Toolbar: Steganos Internet Anonyme - {00000000-5736-4205-0008-f7ed0776fb27} - c:\program files\steganos internet anonym 2006\sia2006iep.dllO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet	hotkey.exeO4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exeO4 - HKLM\..\Run: [TPSMain] TPSMain.exeO4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exeO4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exeO4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClientO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"O4 - HKLM\..\Run: [XoftSpySE] C:\Program Files\XoftSpySE\xoftspy.exe -sO4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /sO4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exeO4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxWatchTray.exe"O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitserviceO4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startupO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exeO4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = C:\Program Files\Diskeeper Corporation\Diskeeper\ESIRegister.exeO4 - Startup: HDDlife.lnk = C:\Program Files\BinarySense\HDDlife\HDDlifePro.exeO4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXEO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Réglage rapide de Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{F494CA16-2EFD-47D3-BC61-AEBC0DF420ED}: NameServer = 213.36.80.1O20 - Winlogon Notify: winjks32 - C:\WINDOWS\SYSTEM32\winjks32.dllO23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exeO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeO23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exeO23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxLiveShare.exeO23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxMediaDB.exeO23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCom\RoxUpnpRenderer.exeO23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exeO23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxWatch.exeO23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

Regis59 · Answer

Salut,ce trojan, qui te le detecte et ou?a+

ribery · Answer

Dans C:\Documents and Settings\boss\Local Settings\Temporary Internet Files\Content.IE5\T5UNUX6P\srvija[1].exe\[UPX]

Regis59 · Answer

Salut

telecharge ceci:

Clean Up 40:
http://pageperso.aol.fr/balltrap34/CleanUp40.exe
-aide en image:(merci à Balltrap34).
http://pageperso.aol.fr/balltrap34/democleanup.htm

Puis lance le comme sur la video.

Reconnecte toi et Rend toi sur ce site :
http://www.virustotal.com/xhtml/virustotal_en.html
Clik sur parcourir
Recherche ceci :
C:\WINDOWS\SYSTEM32\winjks32.dll
Clik send et colle le rapport stp

A+

RIBERY · Answer

voia le rapport du site virustotal.com.xhtml/virustotal_en.html/

STATUS: FINISHED
Complete scanning result of "winjks32.dll", received in VirusTotal at 04.20.2006, 12:19:59 (CET).

Antivirus Version Update Result
AntiVir 6.34.0.24 04.20.2006 TR/Agent.QT.5
Avast 4.6.695.0 04.18.2006 no virus found
AVG 386 04.19.2006 Generic.STY
Avira 6.34.0.56 04.20.2006 TR/Agent.QT.5
BitDefender 7.2 04.20.2006 Backdoor.Vuro.A
CAT-QuickHeal 8.00 04.19.2006 no virus found
ClamAV devel-20060202 04.19.2006 no virus found
DrWeb 4.33 04.20.2006 BackDoor.Vuro
eTrust-InoculateIT 23.71.134 04.19.2006 no virus found
eTrust-Vet 12.4.2169 04.20.2006 no virus found
Ewido 3.5 04.20.2006 Trojan.Agent.qt
Fortinet 2.71.0.0 04.20.2006 W32/Agent.QT!tr
F-Prot 3.16c 04.19.2006 no virus found
Ikarus 0.2.59.0 04.19.2006 Backdoor.Win32.Hupigon.BV
Kaspersky 4.0.2.24 04.20.2006 Trojan.Win32.Agent.qt
McAfee 4744 04.19.2006 no virus found
NOD32v2 1.1497 04.19.2006 Win32/TrojanDownloader.Small.CML
Norman 5.90.16 04.20.2006 no virus found
Panda 9.0.0.4 04.19.2006 Adware/PurityScan
Sophos 4.04.0 04.20.2006 no virus found
Symantec 8.0 04.20.2006 no virus found
TheHacker 5.9.7.131 04.19.2006 no virus found
UNA 1.83 04.18.2006 Trojan.Win32.Agent
VBA32 3.10.5 04.19.2006 BackDoor.Vuro

Aditional Information
File size: 12221 bytes
MD5: 0134b20354fa1aba7f461b949a0d819b
SHA1: a9937db7c21f35fe59f1a9f465408fab939f7e81

Regis59 · Answer

Salut

¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

O20 - Winlogon Notify: winjks32 - C:\WINDOWS\SYSTEM32\winjks32.dll

Puis supprime

C:\WINDOWS\SYSTEM32\winjks32.dll

Redemarre ton pc et remet un log

a+

[trojan] infecté par WIN32:Dialer-527

7 réponses

Votre réponse

Discussions similaires

Newsletters