[virus] Ifecte par winfixer, popups, cpu 100%

beluga68 Messages postés 2 Statut Membre -  
did71 Messages postés 2187 Statut Contributeur sécurité -
Bonjour,

Voila, depuis quelques semaines, chaque fois que je me connecte a internet j'ai des popups qui s'affichent. Les fameux winantivirupro, systemdoctor, drivecleaner, etc...
En plus regulierement le processus explorer.exe me prend 100% du CPU et je doit rebooter.
Pour finir Norton me detecte regulierement winfixer et errorsafe mais ne regle pas le probleme.
Ni Spybot ni Ad-Aware ni Ewido n'ont reussi a regler les problemes non plus. Ils ne cessent pas de revenir.
Si je pouvez m'eviter la corvee du reformatage des diques ce serait plus que tres cool! J'en peux plus!!!

Merci d'avance.

2 réponses

  1. did71 Messages postés 2187 Statut Contributeur sécurité 36
     
    bonsoir beluga68,

    1)Télécharge Blacklight (de F-Secure) et sauvegarde le sur ton Bureau :

    https://europe.f-secure.com/exclude/blacklight/index.shtml

    Double-clique blbeta.exe et accepte la licence, clique Scan puis Next

    Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

    Copie et colle le contenu de ce rapport dans ta prochaine réponse!

    2) télécharge HijackThis, clique sur do a system scan and save a log file:
    http://www.merijn.org/files/hijackthis.zip

    poste le rapport!

    a+
    0
    1. beluga68 Messages postés 2 Statut Membre
       
      Merci de m'avoir repondu did71

      J'ai telecharge Blacklight et HijackThis.

      Voila les rapports:

      ----------------------------------------------------------------------------
      10/18/06 11:52:05 [Info]: BlackLight Engine 1.0.47 initialized
      10/18/06 11:52:05 [Info]: OS: 5.1 build 2600 (Service Pack 2)
      10/18/06 11:52:05 [Note]: 7019 4
      10/18/06 11:52:05 [Note]: 7005 0
      10/18/06 11:52:09 [Note]: 7006 0
      10/18/06 11:52:09 [Note]: 7011 1568
      10/18/06 11:52:09 [Note]: 7026 0
      10/18/06 11:52:10 [Note]: 7026 0
      10/18/06 11:52:16 [Note]: FSRAW library version 1.7.1020
      10/18/06 11:55:20 [Note]: 4020 23040 65536
      10/18/06 11:55:20 [Note]: 4018 23040 65536
      10/18/06 11:55:20 [Note]: 4013 57730
      10/18/06 11:55:20 [Note]: 4020 23040 65536
      10/18/06 11:55:20 [Note]: 4018 23040 65536
      10/18/06 11:55:20 [Note]: 4020 23040 65536
      10/18/06 11:55:20 [Note]: 4018 23040 65536
      10/18/06 11:55:20 [Note]: 4013 57730
      10/18/06 11:55:20 [Note]: 4020 23040 65536
      10/18/06 11:55:20 [Note]: 4018 23040 65536
      10/18/06 11:55:42 [Note]: 2000 1012
      10/18/06 11:56:45 [Note]: 7007 0

      ---------------------------------------------------------------------------

      Logfile of HijackThis v1.99.1
      Scan saved at 12:01:27, on 18/10/2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
      C:\WINDOWS\Explorer.EXE
      c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      c:\Program Files\Norton Internet Security\ISSVC.exe
      c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      C:\Program Files\ewido anti-spyware 4.0\guard.exe
      C:\WINDOWS\System32\FTRTSVC.exe
      C:\Program Files\Alias\Maya7.0\docs\wrapper.exe
      c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Alias\Maya7.0\docs\jre\bin\java.exe
      C:\WINDOWS\system32\svchost.exe
      c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\windows\system\hpsysdrv.exe
      C:\WINDOWS\system32\devldr32.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Logitech\Video\LogiTray.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\HP\KBD\KBD.EXE
      C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\WINDOWS\system32\LVComS.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\RAM Idle LE\RAM_XP.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Alias\Maya7.0\bin\maya.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Program Files\SmartFTP Client 2.0\SmartFTP.exe
      C:\Program Files\DOWNLOAD_TEMP\hijackthis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [URLLSTCK.exe] c:\Program Files\Norton Internet Security\UrlLstCk.exe
      O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
      O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
      O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
      O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
      O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
      O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
      O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle LE\RAM_XP.exe
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
      O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT

      cnx|PARAM


      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
      O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
      O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
      O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
      O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s.work4sure.com/c/ge/w4sgeen9.exe
      O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://visioplace.com/download/cfweb_visioplace.com-download_instmodule.exe
      O16 - DPF: {40C83AF8-FEA7-4A6A-A470-431EE84A0886} (SecureObjectFactory Class) - http://fr.vs.mcafeeasap.com/VS2/bin/myCioAgt.20051113125542.cab
      O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt3.5.0.423.dll (file missing)
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
      O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
      O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
      O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
      O23 - Service: Maya 7.0 Documentation Server (maya70docserver) - Unknown owner - C:\Program Files\Alias\Maya7.0\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya7.0\docs\Wrapper.conf (file missing)
      O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe



      Et voila!
      0
  2. did71 Messages postés 2187 Statut Contributeur sécurité 36
     
    bonsoir,

    renomme hijackthis.exe en scanner.exe et lance un scan scanner.exe!

    poste le rapport ensuite!

    a+
    0