probleme voici mon rapport Fermé

Question

bonjour dite moi si jai un virus ou non car jai un gros soucis avec internet explorer  erci




Logfile of HijackThis v1.99.1 
Scan saved at 01:08:06, on 15/12/2006 
Platform: Windows XP SP2 (WinNT 5.01.2600) 
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) 

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\System32\Ati2evxx.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\System32\MsPMSPSv.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\WINDOWS\system32\wscntfy.exe 
C:\WINDOWS\Explorer.exe 
C:\Program Files\Apoint2K\Apoint.exe 
C:\WINDOWS\system32undll32.exe 
C:\WINDOWS\winmsgr.exe 
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\Documents and Settings\shamin\Bureau\Shareaza\Shareaza.exe 
C:\Program Files\MSN Messenger\msnmsgr.exe 
c:\progra~1\intern~1\iexplore.exe 
C:\Program Files\Internet Explorer\iexplore.exe 
C:\WINDOWS\system32\svchost.exe 
C:\Program Files\MSN Messenger\msvs.exe 
C:\Documents and Settings\shamin\Mes documents\Mes fichiers reçus\HijackThis.exe 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr/ 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.kdadvhdmbeyfsrpcyrnsu.com/ 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr/ 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens 
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe 
O2 - BHO: (no name) - {d8934d9b-71c3-4113-ba73-89b6b4a9c3bd} - C:\WINDOWS\system32\mdmsvr.dll 
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe 
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe 
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe 
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start 
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe 
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot 
O4 - HKLM\..\Run: [IMSCMIG40W] C:\PROGRA~1\FICHIE~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log 
O4 - HKLM\..\Run: [msxct] msxct.exe 
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe 
O4 - HKLM\..\Run: [NI.UWFX5V_0001_LP] "C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5V_0001_LPNetInstaller.exe" 
O4 - HKLM\..\Run: [METASETTINGSWIPECITY] C:\Documents and Settings\All Users\Application Data\NURB ANTE META SETTINGS\coolbody.exe 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
O4 - HKLM\..\Run: [System service79] C:\WINDOWS\\etb\pokapoka79.exe 
O4 - HKLM\..\Run: [WinLogon] C:\WINDOWS\logon.exe 
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe 
O4 - HKLM\..\Run: [WinMsg] C:\WINDOWS\winmsgr.exe 
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe 
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck 
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKCU\..\Run: [Shareaza] "C:\Documents and Settings\shamin\Bureau\Shareaza\Shareaza.exe" -tray 
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI 
O4 - HKCU\..\Run: [Eq Stupid] C:\DOCUME~1\shamin\APPLIC~1\JUGSCA~1\CITY FLAW.exe 
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min 
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trialegclean.exe" -startminimize 
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background 
O4 - HKCU\..\RunServices: [Msn Messengers] msnmsgr.exe 
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe 
O8 - Extra context menu item: Add to QQ Customized Emoticons - C:\Program Files\Tencent\qq\AddEmotion.htm 
O8 - Extra context menu item: Add to QQ Customized Panel - C:\Program Files\Tencent\qq\AddPanel.htm 
O8 - Extra context menu item: Add to QQ Emotions - C:\Program Files\Tencent\qq\AddEmotion.htm 
O8 - Extra context menu item: Send picture by MMS - C:\Program Files\Tencent\qq\SendMMS.htm 
O8 - Extra context menu item: Send Picture with QQ MMS - C:\Program Files\Tencent\qq\SendMMS.htm 
O8 - Extra context menu item: Upload to QQ Network Hard Disk - C:\Program Files\Tencent\qq\AddToNetDisk.htm 
O8 - Extra context menu item: ·¢ËÍÍ¼Æ¬µ½ÊÖ»ú(&M) - http://sms.sina.com.cn/diy/send.html?from=467 
O8 - Extra context menu item: Ê¹ÓÃ²ÊÐÅ³¬¼¶×ÔÐ´·¢ËÍµ½ÊÖ»ú - http://mms.sina.com.cn/mmsnews.html 
O8 - Extra context menu item: ÊÕ²Ø´ËÒ³µ½ÐÂÀËViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt 
O8 - Extra context menu item: Ìí¼Óµ½QQ±íÇé - C:\Program Files\Tencent\QQ\AddEmotion.htm 
O8 - Extra context menu item: Ìí¼Óµ½QQ×Ô¶¨ÒåÃæ°å - C:\Program Files\Tencent\QQ\AddPanel.htm 
O8 - Extra context menu item: ÐÂÀËËÑË÷ - http://cha.sina.com.cn/ddt.html 
O8 - Extra context menu item: ÓÃQQ²ÊÐÅ·¢ËÍ¸ÃÍ¼Æ¬ - C:\Program Files\Tencent\QQ\SendMMS.htm 
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin
pjpi150_08.dll 
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin
pjpi150_08.dll 
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing) 
O9 - Extra 'Tools' menuitem: ÌÚÑ¶QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing) 
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) 
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O9 - Extra button: (no name) - {974AD624-EA50-4831-A6C0-3040F6665396} - C:\WINDOWS\Downlo~1ssband.dll (HKCU) 
O9 - Extra 'Tools' menuitem: ???????? - {974AD624-EA50-4831-A6C0-3040F6665396} - C:\WINDOWS\Downlo~1ssband.dll (HKCU) 
O9 - Extra button: ???????? - {F0646DC8-58CD-4C64-8F6B-525043914685} - C:\WINDOWS\Downlo~1ssband.dll (HKCU) 
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/ 
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/fra_pao_med.exe 
O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exe 
O16 - DPF: {00000000-0709-0000-0000-000330050660} - http://207.234.185.217/aboxinst_int21.exe 
O16 - DPF: {00001000-0709-0000-0000-000330050660} - http://207.234.185.217/aboxinst_int22.exe 
O16 - DPF: {00330010-0000-0000-0000-000020060010} - http://207.234.185.217/ABoxInst_int22.exe 
O16 - DPF: {00330010-0000-0000-0000-000020160010} - http://207.234.185.217/ABoxInst_int25.exe 
O16 - DPF: {00330010-0000-0000-0000-000020160026} - http://207.234.185.217/installer/ABoxInst_int26.exe 
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - https://www.afternic.com/domains/drivecleaner.com 
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab 
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - https://www.afternic.com/domains/drivecleaner.com 
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} - http://iebar.t2t2.com/iebar.cab 
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.playqames.com/default.cab?uid=9&id=60953&1s&ex&ppd=4 
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab 
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - https://www.afternic.com/domains/errorsafe.com 
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} - http://advnt01.com/dialer/internazionale_ver11.CAB 
O16 - DPF: {DC4C23C4-A7A3-4014-9A83-3C1BE131F39E} (VacPro.int_ver34v) - http://advnt01.com/dialer/int_ver34v.CAB 
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - https://www.afternic.com/domains/errorsafe.com 
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL 
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL 
O20 - AppInit_DLLs: 
O20 - Winlogon Notify: mdmsvr - C:\WINDOWS\SYSTEM32\mdmsvr.dll 
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe 
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Séb08 · Answer

slt,

tu es infecté par Vundo ...

Télécharge VundoFix (par Atribune) de ce lien : 
http://www.atribune.org/ccount/click.php?id=4 

* Sauvegarde-le sur ton Bureau. 
* Double-clique VundoFix.exe afin de le lancer 
* Clique sur le bouton Scan for Vundo 
* Lorsque le scan est complété, clique sur le bouton Remove Vundo 
* Une invite te demandera si tu veux supprimer les fichiers, clique YES 
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers 
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK 
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse. 

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo"

a+

flocola · Answer

rapport 


no infected files were found



:/

Séb08 · Answer

Hein ?

Remet un log Hijack STP

a+

Probleme voici mon rapport

3 réponses

Discussions similaires