[Virus] Attaqué par dialer, downloader etc.
Bonsoir à tous,
Comme d'autres je suis attaqué par dialer. trojan, Downloader et autres joyeusetés. J'ai lu sur ce forum certaines manipulations à faire mais qui me semblent toutes très personnalisées et je crains de tout planter en extrapolant. NORTON est en veille permanente et j'ai installé CCleaner, Spybot, Hijackthis et Ad-Aware. Une aide serait la bienvenue.
Merci d'avance
Comme d'autres je suis attaqué par dialer. trojan, Downloader et autres joyeusetés. J'ai lu sur ce forum certaines manipulations à faire mais qui me semblent toutes très personnalisées et je crains de tout planter en extrapolant. NORTON est en veille permanente et j'ai installé CCleaner, Spybot, Hijackthis et Ad-Aware. Une aide serait la bienvenue.
Merci d'avance
6 réponses
-
Contributeur sécuritéSalut
Lance HijackThis puis:
clique sur "do a system scan and save logfile" (cf démo)
faire un copier coller du log entier sur le forum
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm
Bon courage
A+ -
Merci pour la rapidité du contact.
Logfile of HijackThis v1.99.1
Scan saved at 19:33:28, on 08/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\Logi_MwX.Exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\RACLE~1\wowexec.exe
C:\Documents and Settings\Phillipe\Application Data\?ymantec\n?pdb.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Phillipe\Bureau\hijackthis\scanner.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {CA2121B7-BD2B-B4F2-7BE0-BC9E8A465690} - C:\WINDOWS\system32\aidyba.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {29CF77AD-303C-4CA5-B205-F539DA048E1B} - C:\WINDOWS\system32\urssr.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CA2121B7-BD2B-B4F2-7BE0-BC9E8A465690} - C:\WINDOWS\system32\aidyba.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\akdvourc.dll (file missing)
O3 - Toolbar: SuperBar - {2794DDCD-A137-4857-A4DB-AA7895F671EB} - C:\Program Files\SUPERBAR\SUPERBAR.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Vua3cMfCZ] C:\WINDOWS\nsbmwx.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Brab] "C:\WINDOWS\RACLE~1\wowexec.exe" -vt yazb
O4 - HKCU\..\Run: [Szf] C:\Documents and Settings\Phillipe\Application Data\?ymantec\n?pdb.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O20 - Winlogon Notify: urssr - C:\WINDOWS\system32\urssr.dll
O20 - Winlogon Notify: windeu32 - C:\WINDOWS\SYSTEM32\windeu32.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
A+
Dady -
Contributeur sécuritéRe Daddy,
Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
Double-clique VundoFix.exe afin de le lancer.
Coche Run VundoFix as a task.
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok
Clique sur le bouton Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
Démarre ton PC à nouveau.
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.-
Voilà, c'est fait
VundoFix V6.2.8
Checking Java version...
Java version is 1.4.2.3
Java version is 1.5.0.3
Java version is 1.5.0.6
Scan started at 20:59:55 08/11/2006
Listing files found while scanning....
C:\WINDOWS\SYSTEM32\windeu32.dll
C:\WINDOWS\system32\urssr.dll
C:\WINDOWS\system32\rssru.ini
C:\WINDOWS\system32\rssru.bak1
C:\WINDOWS\system32\rssru.bak2
Beginning removal...
Attempting to delete C:\WINDOWS\SYSTEM32\windeu32.dll
C:\WINDOWS\SYSTEM32\windeu32.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\urssr.dll
C:\WINDOWS\system32\urssr.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\rssru.ini
C:\WINDOWS\system32\rssru.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\rssru.bak1
C:\WINDOWS\system32\rssru.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\rssru.bak2
C:\WINDOWS\system32\rssru.bak2 Has been deleted!
Performing Repairs to the registry.
Done!
Logfile of HijackThis v1.99.1
Scan saved at 21:10:48, on 08/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\RACLE~1\wowexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Phillipe\Application Data\?ymantec\n?pdb.exe
C:\Documents and Settings\Phillipe\Bureau\hijackthis\scanner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {CA2121B7-BD2B-B4F2-7BE0-BC9E8A465690} - C:\WINDOWS\system32\aidyba.dll (file missing)
R3 - URLSearchHook: (no name) - {27B523B7-EE7E-B0AA-2C55-B7CE1FCFBDCC} - C:\WINDOWS\system32\milbsxhe.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {27B523B7-EE7E-B0AA-2C55-B7CE1FCFBDCC} - C:\WINDOWS\system32\milbsxhe.dll
O2 - BHO: (no name) - {29CF77AD-303C-4CA5-B205-F539DA048E1B} - C:\WINDOWS\system32\urssr.dll (file missing)
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CA2121B7-BD2B-B4F2-7BE0-BC9E8A465690} - C:\WINDOWS\system32\aidyba.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\akdvourc.dll (file missing)
O3 - Toolbar: SuperBar - {2794DDCD-A137-4857-A4DB-AA7895F671EB} - C:\Program Files\SUPERBAR\SUPERBAR.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Vua3cMfCZ] C:\WINDOWS\nsbmwx.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Brab] "C:\WINDOWS\RACLE~1\wowexec.exe" -vt yazb
O4 - HKCU\..\Run: [Szf] C:\Documents and Settings\Phillipe\Application Data\?ymantec\n?pdb.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
Merci de ton aide
-
-
ModérateurBonsoir,
Sur HijackThis, coche ces lignes :
R3 - URLSearchHook: (no name) - {CA2121B7-BD2B-B4F2-7BE0-BC9E8A465690} - C:\WINDOWS\system32\aidyba.dll (file missing)
O2 - BHO: (no name) - {27B523B7-EE7E-B0AA-2C55-B7CE1FCFBDCC} - C:\WINDOWS\system32\milbsxhe.dll
O2 - BHO: (no name) - {29CF77AD-303C-4CA5-B205-F539DA048E1B} - C:\WINDOWS\system32\urssr.dll (file missing)
O2 - BHO: (no name) - {CA2121B7-BD2B-B4F2-7BE0-BC9E8A465690} - C:\WINDOWS\system32\aidyba.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\akdvourc.dll (file missing)
O3 - Toolbar: SuperBar - {2794DDCD-A137-4857-A4DB-AA7895F671EB} - C:\Program Files\SUPERBAR\SUPERBAR.dll (file missing)
O4 - HKCU\..\Run: [Brab] "C:\WINDOWS\RACLE~1\wowexec.exe" -vt yazb
O4 - HKCU\..\Run: [Szf] C:\Documents and Settings\Phillipe\Application Data\?ymantec\n?pdb.exe
--> clic sur fix checked
-- Ouvre le poste de travail
-- Clic sur le menu outils en haut à droite puis options des dossiers
-- Dans la nouvelle fenêtre, clic sur l'onglet Affichage en haut
-- Coche dans la liste "Afficher les fichiers cachés"
-- Décoche "masquer les fichier proteger du systeme d exploitation (recommandée)"
-- Tu vas recevoir un message qui te dit que cela peut endommager le système, n'en tiens pas compte.
Supprime : C:\WINDOWS\system32\milbsxhe.dll
Télécharge ce fichier - http://download.bleepingcomputer.com/sUBs/combofix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
Double-clic sur combofix, Il va te poser une question, réponds yes (touche y) puis attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
Puis :
Ouvre internet explorer --> Outils --> Options internet --> onglet "sécurité" --> Valide "niveau par défaut".
Toujours sur Internet explorer --> Outils --> Options internet --> onglet "avancé" --> valide "Paramètres par défaut".
Pour effectuer les scans, désactive ton antivirus, logiciels de protections et logiciels pouvant bloquer les popups (barres Google, barres Yahoo etc..).
- Fais un panda https://www.pandasecurity.com/?ref=www.pandasoftware.com/products/activescan.htm]scan avec panda en désactivant ton antivirus pendant le scan!
(Si tu es perdu, tu peux suivre ce tuto : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId237368
- Copie/colle le rapport panda ici-
Bonjour et merci pour la réponse
Voici le rappprt combofix :
Phillipe - 06-11-09 9:19:47.38 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Phillipe\Bureau"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\QooBox\Purity\Documents and Settings\Phillipe\Application Data\YMANTE~1
C:\QooBox\Purity\Documents and Settings\Phillipe\Application Data\YMANTE~1\n?pdb.exe
C:\QooBox\Purity\Program Files\MCROSO~1
C:\QooBox\Purity\WINDOWS\RACLE~1
C:\QooBox\Purity\WINDOWS\RACLE~1\wowexec.exe
C:\QooBox\Purity\WINDOWS\RACLE~1\?racle
((((((((((((((((((((((((((((((( Files Created from 2006-10-09 to 2006-11-09 ))))))))))))))))))))))))))))))))))
2006-11-05 16:34 2 --a------ C:\WINDOWS\SYSTEM32\wapisvcc.exe
2006-11-05 16:29 40,973 ---hs---- C:\WINDOWS\SYSTEM32\pmnmlkj.dll
2006-10-29 17:43 86,016 --a------ C:\WINDOWS\unvise32.exe
2006-10-09 07:12 1,343,488 --a------ C:\WINDOWS\SYSTEM32\FreeImage.dll
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-11-09 09:18 -------- d-------- C:\Program Files\Mozilla Thunderbird
2006-11-09 09:18 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-08 22:38 -------- d-------- C:\Program Files\eMule
2006-11-07 17:04 -------- d-------- C:\Program Files\Symantec Technical Support
2006-11-07 16:47 -------- d-------- C:\Program Files\VSAdd-in
2006-11-07 13:19 -------- d-------- C:\Program Files\QuickTime
2006-11-07 09:08 -------- d-------- C:\Program Files\CCleaner
2006-11-06 17:20 -------- d-------- C:\Program Files\Fichiers communs
2006-11-06 10:55 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\Lavasoft
2006-11-06 10:54 -------- d-------- C:\Program Files\Lavasoft
2006-11-02 21:42 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\MSNStockQuote
2006-11-01 19:02 -------- d-------- C:\Program Files\File List Creator
2006-11-01 18:38 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2006-11-01 18:38 249856 --------- C:\WINDOWS\Setup1.exe
2006-11-01 17:22 -------- d-------- C:\Program Files\pcatalog
2006-10-31 18:08 -------- d-------- C:\Program Files\IGC
2006-10-29 22:13 -------- d-------- C:\Program Files\MUSK Codec Pack v5
2006-10-29 17:43 -------- d-------- C:\Program Files\DivXLand
2006-10-29 11:31 -------- d-------- C:\Program Files\Guide Divx
2006-10-27 13:31 -------- d-------- C:\Program Files\SPAMfighter
2006-10-27 13:31 -------- d-------- C:\Program Files\Fichiers communs\Ankiro
2006-10-27 13:30 -------- d-------- C:\Program Files\Fichiers communs\Application
2006-10-24 20:38 -------- d-------- C:\Program Files\Geneatique2006
2006-10-24 20:27 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-24 20:26 -------- d-------- C:\Program Files\Dell
2006-10-24 20:22 -------- d-------- C:\Program Files\Adobe
2006-10-23 22:00 -------- d-------- C:\Program Files\Combined Community Codec Pack
2006-10-23 07:01 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-10-22 19:15 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\Apple Computer
2006-10-21 21:44 -------- d-------- C:\Program Files\adslTV
2006-10-21 16:34 -------- d-------- C:\Program Files\FontView
2006-10-21 11:01 -------- d-------- C:\Program Files\ffdshow
2006-10-18 21:55 -------- d-------- C:\Program Files\DivX
2006-10-18 21:27 -------- d-------- C:\Program Files\Virtual Dub
2006-10-18 13:43 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\DivX
2006-10-15 20:29 -------- d-------- C:\Program Files\iTunes
2006-10-15 20:29 -------- d-------- C:\Program Files\iPod
2006-10-09 21:30 -------- d-------- C:\Program Files\Symantec
2006-10-08 20:47 -------- d-------- C:\Program Files\Yahoo!
2006-10-07 16:46 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\vlc
2006-10-02 20:04 806912 --a------ C:\WINDOWS\SYSTEM32\divx_xx0c.dll
2006-10-02 20:04 806912 --a------ C:\WINDOWS\SYSTEM32\divx_xx07.dll
2006-10-02 20:04 790528 --a------ C:\WINDOWS\SYSTEM32\divx_xx11.dll
2006-10-02 20:04 635486 --a------ C:\WINDOWS\SYSTEM32\DivX.dll
2006-09-29 17:48 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\dvdcss
2006-09-23 11:43 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\Jasc Software Inc
2006-09-23 11:37 -------- d-------- C:\Program Files\Google
2006-09-23 11:08 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\ZangoToolbar
2006-09-23 10:40 -------- d-------- C:\Program Files\ZangoToolbar
2006-09-15 21:52 91904 --a--c--- C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2006-09-15 21:52 124016 --a--c--- C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS
2006-09-15 12:40 -------- d-------- C:\Documents and Settings\Phillipe\Application Data\Template
2006-09-13 16:39 -------- d-------- C:\Program Files\Fichiers communs\Microsoft Shared
2006-09-13 16:29 -------- d-------- C:\Program Files\OfficeUpdate11
2006-09-13 06:03 1084416 --a------ C:\WINDOWS\SYSTEM32\msxml3.dll
2006-09-09 22:56 -------- d-------- C:\Program Files\Fichiers communs\AVSMedia
2006-09-09 22:51 -------- d-------- C:\Program Files\Norton AntiVirus
2006-09-09 14:45 -------- d-------- C:\Program Files\AVSMedia
2006-08-29 20:41 48592 --a------ C:\Documents and Settings\Phillipe\Application Data\GDIPFONTCACHEV1.DAT
2006-08-25 16:51 617472 --a------ C:\WINDOWS\SYSTEM32\comctl32.dll
2006-08-21 13:26 16896 --a------ C:\WINDOWS\SYSTEM32\fltlib.dll
2006-08-21 10:14 23040 --a------ C:\WINDOWS\SYSTEM32\fltmc.exe
2006-08-16 12:59 100352 --a------ C:\WINDOWS\SYSTEM32\6to4svc.dll
2006-08-11 00:03 73728 --a------ C:\WINDOWS\SYSTEM32\dpl100.dll
2006-08-11 00:03 196608 --a------ C:\WINDOWS\SYSTEM32\dtu100.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"BCMSMMSG"="BCMSMMSG.exe"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Vua3cMfCZ"="C:\\WINDOWS\\nsbmwx.exe"
"Logitech Utility"="Logi_MwX.Exe"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"ccApp"="\"C:\\Program Files\\Fichiers communs\\Symantec Shared\\ccApp.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"SPAMfighter Agent"="\"C:\\Program Files\\SPAMfighter\\SFAgent.exe\" update delay 60"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=hex:95,00,00,00
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^IEEE802.11b WLAN Card Utility.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Démarrer\\Programmes\\Démarrage\\IEEE802.11b WLAN Card Utility.lnk"
"backup"="C:\\WINDOWS\\pss\\IEEE802.11b WLAN Card Utility.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\ZyXEL\\IEEE80~1.11B\\WLPCCfg.exe "
"item"="IEEE802.11b WLAN Card Utility"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Rappels du Calendrier Microsoft Works.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Démarrer\\Programmes\\Démarrage\\Rappels du Calendrier Microsoft Works.lnk"
"backup"="C:\\WINDOWS\\pss\\Rappels du Calendrier Microsoft Works.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\FICHIE~1\\MICROS~1\\WORKSS~1\\wkcalrem.exe "
"item"="Rappels du Calendrier Microsoft Works"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQ3HelperStartUp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AQ3HEL~1"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\AQUATI~1\\AQ3HEL~1.EXE /partner AQ3"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BullsEye Network]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bargains"
"hkey"="HKLM"
"command"="C:\\Program Files\\BullsEye Network\\bin\\bargains.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A920]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dlbkbmgr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Dell AIO Printer A920\\dlbkbmgr.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="quickset"
"hkey"="HKLM"
"command"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DVDLauncher"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eCarteBleue-SG-P3]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ECB-SG"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\e-Carte Bleue\\SG\\e-Carte Bleue\\ECB-SG.exe\" /dontopenmycards"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hipvbyt]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ihrih"
"hkey"="HKLM"
"command"="C:\\Program Files\\Xokh\\Ihrih.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\igfxtray.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="InCD"
"hkey"="HKLM"
"command"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="optimize"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Internet Optimizer\\optimize.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessagerStarter Wanadoo]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="StartMessager"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\MESSAG~1\\StartMessager.exe Messager Wanadoo"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WksSb"
"hkey"="HKLM"
"command"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WkDetect"
"hkey"="HKLM"
"command"="C:\\Program Files\\Microsoft Works\\WkDetect.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsnMsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PCMService"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power Scan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="powerscan"
"hkey"="HKLM"
"command"="C:\\Program Files\\Power Scan\\powerscan.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RealPlay"
"hkey"="HKLM"
"command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sais]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sais"
"hkey"="HKLM"
"command"="c:\\program files\\180searchassistant\\sais.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SurfAccuracy]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SAcc"
"hkey"="HKLM"
"command"="C:\\Program Files\\SurfAccuracy\\SAcc.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SNDMon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherCast]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Weather"
"hkey"="HKCU"
"command"="C:\\Program Files\\WeatherCast\\Weather.exe /q"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Save"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Save\\Save.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="C:\\Program Files\\Winamp\\winampa.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CnxMon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Wanadoo\\CnxMon.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TaskbarIcon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Wanadoo\\TaskbarIcon.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Watch"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Wanadoo\\Watch.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wkfud"
"hkey"="HKLM"
"command"="C:\\Program Files\\Microsoft Works\\wkfud.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zango]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zango"
"hkey"="HKLM"
"command"="\"c:\\program files\\zango\\zango.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=dword:00000003
"RDSessMgr"=dword:00000003
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Analyser mon ordinateur - Phillipe.job
C:\WINDOWS\tasks\Norton AntiVirus - Analyser mon ordinateur.job
C:\WINDOWS\tasks\Rappel d'abonnement 1 auprŠs de l'ISP.job
C:\WINDOWS\tasks\Symantec NetDetect.job
C:\WINDOWS\tasks\{0A3E8EE3-68B7-40CB-9AA5-5B2FBB92C392}_PBX_Phillipe.job
C:\WINDOWS\tasks\{96FF1232-8FAA-4EA3-B89D-98E59C3595D8}_PBX_Phillipe.job
C:\WINDOWS\tasks\{EC28F85C-38E1-4A2B-AF7B-A8BAF2AB114D}_PBX_Phillipe.job
Completion time: 06-11-09 9:21:24.84
C:\ComboFix.txt ... 06-11-09 09:21
A+
dady
-
-
Re
Voici le rapport Panda :
Incident Status Location
Spyware:spyware/new.net Not disinfected c:\windows\NDNuninstall6_38.exe
Adware:adware/whenusearch Not disinfected Windows Registry
Adware:adware/savenow Not disinfected Windows Registry
Adware:adware/ist.sidefind Not disinfected Windows Registry
Adware:adware/superbar Not disinfected Windows Registry
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.xiti.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Smartadserver Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.smartadserver.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[as1.falkag.de/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Comclick Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[fl01.ct2.comclick.com/]
Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Phillipe\Application Data\Mozilla\Firefox\Profiles\ofgq4rvj.default\cookies.txt[.adviva.net/]
Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Phillipe\Bureau\hijackthis\backups\backup-20061109-091545-215.dll
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Phillipe\Cookies\phillipe@atdmt[2].txt
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Phillipe\Cookies\phillipe@weborama[2].txt
Security Risk:HackTool/Gendel.A Not disinfected C:\gendel32.exe
Possible Virus. Not disinfected C:\QooBox\Purity\Documents and Settings\Phillipe\Application Data\YMANTE~1\n?pdb.exe
Merci encore -
ModérateurDésinstalle : VSAdd-in
-- Ouvre le poste de travail
-- Clic sur le menu outils en haut à droite puis options des dossiers
-- Dans la nouvelle fenêtre, clic sur l'onglet Affichage en haut
-- Coche dans la liste "Afficher les fichiers cachés"
-- Décoche "masquer les fichier proteger du systeme d exploitation (recommandée)"
-- Tu vas recevoir un message qui te dit que cela peut endommager le système, n'en tiens pas compte.
Supprime :
C:\QooBox\
C:\WINDOWS\SYSTEM32\wapisvcc.exe
C:\WINDOWS\SYSTEM32\pmnmlkj.dll
C:\WINDOWS\unvise32.exe
c:\windows\NDNuninstall6_38.exe
C:\gendel32.exe
C:\Program Files\VSAdd-in
C'est OK en suivant les dernières manipulations ci-dessous :)
Essaye de rapporter ton infection sur le site que je te donne ci-dessous, ce serait super cool ;)
- Nettoye ton ordinateur avec CCleaner : https://www.malekal.com/tutoriel-ccleaner/
- Désactive puis réactive la restauration du système :
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924
Tu peux ensuite désinstaller tous les programmes que l'on a utilisé.
je t'invite à jeter un coup d'oeil à ces liens dans la mesure du possible, essaye de rapporter ton infection :
[b]Comment se protéger des virus :[/b] - Tout ceci est résume sur cette page : https://www.malekal.com/proteger-pc-virus-pirates/
[b]Rapporte ton infection[/b] pour faire condamner les auteurs sur Malware-Complaints. Pour [b]faire entendre notre voix[/b], nous devons être le plus nombreux possibles, alors rapport ton infection :
- Voir les règles :[https://malwarecomplaints.info/
- Enregistre sur le forum à partir du bouton register en haut :
Si tu as [b]plus[/b] de 13 ans, choisir : I Agree to these terms and am over or exactly 13 years of age
Si tu as [b]moins[/b], clic sur : I Agree to these terms and am under 13 years of age
Après t'être enregistré, tu as sous forme de liste les types d'infection (Look2Me, Smitfraud, SpywareQuake etc..) : http://www.malwarecomplaints.info/viewforum.php?f=10&sid=0ea0981a2025873f8e115fda8cee41a4
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas quelle infection tu as eu, créé un message dans le sujet "[b]Autres infections[/b]" conforme au règle du forum (age, ville, département etc..) : https://malwarecomplaints.info/
Pour poster un message, clics sur le bouton "post reply" et remplir les informations - [b]NE PAS CREER UN SUJET[/b] avec le bouton New Topic.
[b]Pour toutes aides pour poster ton message, tu peux consulter ce lien : http://www.malekal.com/malwarecomplaints.html[/b]
Si tu as des questions ou des problèmes, [b]n'hésites pas[/b] à me demander ici ou à contacter un des modérateurs du forum : Kimberly, AgnesD ou ipl_001.
