[Virus] Infecté par iworm_attck_122.02a

Fermé

gwen - 12 mai 2006 à 12:38
Utilisateur anonyme - 12 mai 2006 à 16:27

Bonjour a tout les pro de ce forum,

Donc voila depuis 2 jours je suis infecté par iworm_attck_122.02a.
J'ai fait le rapport avec Hijackthis que je joins si dessous

Logfile of HijackThis v1.99.1
Scan saved at 11:53:29, on 12/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atmclk.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\windows\defender1.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\progra~1\mcafee\MCAFEE~1\masalert.exe
C:\Apps\EZHome\EZStatus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\steam\steam.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\progra~1\mcafee\mcafee antispyware\massrv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymSCUI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\ALCFDRTM.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\gwenael\Local Settings\Temporary Internet Files\Content.IE5\KLWXEBWH\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hp63DA.tmp (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [defender] C:\windows\defender1.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
O4 - HKCU\..\Run: [EzStatus] C:\Apps\EZHome\EZStatus.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: winjgf32 - winjgf32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Z3dlbmFlbA\command.exe (file missing)
O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

merci pour votre aide
a+

A voir également:

[Virus] Infecté par iworm_attck_122.02a
Youtu.be virus - Accueil - Guide virus
Svchost.exe virus - Guide
Operagxsetup virus ✓ - Forum Virus
L'ordinateur d'arthur a été infecté par un virus répertorié récemment. son anti-virus ne l'a pas détecté. qu'a-t-il pu se passer ? - Forum Virus
Virus non détecté par mon anti-virus ? ✓ - Forum Antivirus

2 réponses

Réponse 1 / 2

Utilisateur anonyme
12 mai 2006 à 13:00

Salut,
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hp63DA.tmp (file missing)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [defender] C:\windows\defender1.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O20 - Winlogon Notify: winjgf32 - winjgf32.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Z3dlbmFlbA\command.exe (file missing)

Clique sur demarrer, executer, tape: services.msc ,cherche dans la liste cette ligne et regle la sur "desactivé"

Command Service

Clique sur demarrer, rechercher, cherche et supprime ces fichiers si present:

command.exe
winjgf32.dll
ALCMTR.EXE
hp63DA.tmp
defender1.exe

si un fichier persiste lors de la suppression fais ceci:
-Redemarres ton pc, dès l'allumage de celui ci tapotes la touche f8, à l'ecran qui va apparaitre choisis "mode sans echec" attends un peu.. puis vas supprimer les fichiers/dossiers, vides ta corbeille et redemarres normalement

Fait ça:

Telecharge, installe puis mets à jour ce logiciel, une fois que c'est fait, fais un scan complet de ton systeme et colle le rapport ici avec un nouveau rapport hijackthis
Ewido:
Ewido Security Suite

gwen
12 mai 2006 à 15:56

voila le raport de ewido:
---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 15:51:56, 12/05/2006
+ Somme de contrôle: 8F490313

+ Résultats du scan:

HKU\S-1-5-21-2476500691-1465775542-219479685-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} -> Adware.2020Search : Nettoyer et sauvegarder
:mozilla.6:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder
:mozilla.7:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder
:mozilla.8:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder
:mozilla.9:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder
:mozilla.10:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder
:mozilla.12:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder
:mozilla.14:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyer et sauvegarder
:mozilla.16:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.17:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.26:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
:mozilla.27:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
:mozilla.28:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
:mozilla.29:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
:mozilla.34:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyer et sauvegarder
:mozilla.35:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.36:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.37:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.38:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.39:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyer et sauvegarder
:mozilla.40:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyer et sauvegarder
:mozilla.41:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyer et sauvegarder
:mozilla.42:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyer et sauvegarder
:mozilla.44:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyer et sauvegarder
:mozilla.45:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyer et sauvegarder
:mozilla.46:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyer et sauvegarder
:mozilla.50:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Estat : Nettoyer et sauvegarder
:mozilla.53:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
:mozilla.54:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
:mozilla.55:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
:mozilla.56:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
:mozilla.59:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Webtrendslive : Nettoyer et sauvegarder
:mozilla.63:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
:mozilla.64:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
:mozilla.65:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder
:mozilla.75:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder
:mozilla.76:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder
:mozilla.77:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder
:mozilla.99:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
:mozilla.100:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
:mozilla.102:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
:mozilla.117:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
:mozilla.118:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
:mozilla.119:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
:mozilla.120:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
:mozilla.121:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
:mozilla.134:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Adtech : Nettoyer et sauvegarder
:mozilla.135:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Adtech : Nettoyer et sauvegarder
:mozilla.145:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyer et sauvegarder
:mozilla.146:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Burstnet : Nettoyer et sauvegarder
:mozilla.147:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Burstnet : Nettoyer et sauvegarder
:mozilla.154:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyer et sauvegarder
:mozilla.176:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyer et sauvegarder
:mozilla.179:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Goldenpalace : Nettoyer et sauvegarder
:mozilla.217:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Esomniture : Nettoyer et sauvegarder
:mozilla.226:C:\Documents and Settings\gwenael\Application Data\Mozilla\Firefox\Profiles\07fkgnsf.default\cookies.txt -> TrackingCookie.Valueclick : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@burstnet[1].txt -> TrackingCookie.Burstnet : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@kmpads[1].txt -> TrackingCookie.Kmpads : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@tacoda[1].txt -> TrackingCookie.Tacoda : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Cookies\gwenael@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Local Settings\Temporary Internet Files\Content.IE5\371ZBD0O\defender1[1].exe -> Hijacker.VB.ly : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Local Settings\Temporary Internet Files\Content.IE5\Q12TIDUZ\drsmartload_js[1].htm -> Downloader.IstBar.j : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Local Settings\Temporary Internet Files\Content.IE5\QRUV25A3\drsmartload_js[1].htm -> Downloader.IstBar.j : Nettoyer et sauvegarder
C:\Documents and Settings\gwenael\Local Settings\Temporary Internet Files\Content.IE5\QRUV25A3\YazzleActiveX[1].cab/YazzleActiveX.ocx -> Adware.MediaTickets : Nettoyer et sauvegarder
C:\WINDOWS\system32\atmclk.exe -> Trojan.Small : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win25.tmp.exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win6.tmp.exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win6C.tmp.exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder

::Fin du rapport

et le raport de HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 15:56:26, on 12/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\progra~1\mcafee\MCAFEE~1\masalert.exe
C:\Apps\EZHome\EZStatus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\program files\steam\steam.exe
c:\progra~1\mcafee\mcafee antispyware\massrv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymSCUI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\gwenael\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [EzStatus] C:\Apps\EZHome\EZStatus.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - CMD Technology, Inc. - (no file)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

merci pour ton aide.

gwen
12 mai 2006 à 15:57

Utilisateur anonyme > gwen
12 mai 2006 à 16:27

Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

Clique sur deamrrer, executer, tape: services.msc ,cherche et regle cette ligne sur désactivé"

Network Monitor

Celle ci sur "manuel"

MysqlInventime

Cellle la sur "desactivé" si tu n'as plus de produit Symantec/Norton:

SymWMI Service

clique sur deamrrer, rechercher, cherche et supprime ce fichier si present:

netmon.exe

si un fichier persiste lors de la suppression fais ceci:
-Redemarres ton pc, dès l'allumage de celui ci tapotes la touche f8, à l'ecran qui va apparaitre choisis "mode sans echec" attends un peu.. puis vas supprimer les fichiers/dossiers, vides ta corbeille et redemarres normalement

Fait ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X, pour le faire fonctionner,
une fois qu'il a terminé colle le rapport ici stp, puis je pense que ça sera ok.

https://www.bitdefender.com/toolbox/

Réponse 2 / 2

gwen
12 mai 2006 à 15:59

Désolé dans avoir mis 2!!!

Discussions similaires

Est ce que le site tlauncher est dangereux ?

Softonic,est-ce un virus ?

Virus détecté

4 virus en raison d’un porno ????

infecté par des virus