your computer is infected Résolu/Fermé

Question

bonjour
quelqu'un peut 'il m'aider à me débarasser de ce spyware "your computer is infected" ? 
je vous en remercie beaucoup.
bluesky6740

voici le rapport hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 15:20:58, on 23/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\D-Tools\daemon.exe
C:\PROGRA~1\PASSWO~1	lpd.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
C:\WINDOWS\system32\ctpmon.exe
C:\WINDOWS\FSScrCtl.exe
C:\WINDOWS\system32\ctpmon.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Norton AntiVirus
avapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\ERIC\Mes documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [Password Door Loader] C:\PROGRA~1\PASSWO~1	lpd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ctpmon] ctpmon.exe
O4 - Startup: Screen Saver Control.lnk = C:\WINDOWS\FSScrCtl.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061023/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/dd/install/guidedsolutions.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{7A3FEACA-F7A0-46C5-B3DB-FC9473BEE626}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB0044A7-A1AA-48A3-948D-475C98E90BFB}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.36 85.255.112.23
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.36 85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.36 85.255.112.23
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: hpdj7600 - Unknown owner - C:\DOCUME~1\ERIC\LOCALS~1\Temp\hpdj7600.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

salwa5 · Accepted Answer

bonjour telecharge SmitfraudFix

http://siri.urz.free.fr/Fix/SmitfraudFix.zip   
decompresse  le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport 
Copie/colle le sur le poste stp. 

a+++

salwa5 · Answer

Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 
---------------------------------------------------------------------------- 
Relance le programme Smitfraud, 
Cette fois choisit l’option 2, répond oui a tous ; 
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé ici

salwa5 · Answer

tu as toujour l'alerte " your computer is infected"??

a++++

salwa5 · Answer

ok :) 

* Télécharge FixWareout d'un de ces deux sites sur le bureau: 
http://downloads.subratam.org/Fixwareout.exe 
http://swandog46.geekstogo.com/Fixwareout.exe 

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish. 
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal. 

*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) ici

ouvre hijack coches ces lignes puis click sur fix checked

O4 - HKCU\..\Run: [ctpmon] ctpmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/


O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{563DC6E9-835B-4BC8-AF59-1FA325B7C457}: NameServer = 85.255.114.36,85.255.112.23

O23 - Service: hpdj7600 - Unknown owner - C:\DOCUME~1\ERIC\LOCALS~1\Temp\hpdj7600.exe (file missing)


supprime les fichiers inutiles (fichiers temporaire , cookies .. ect avec ceci

Ccleaner
https://www.malekal.com/tutoriel-ccleaner/

a++++

salwa5 · Answer

j'ai oublier un truc avant de lancer ccleaner 

redemare en mode sans echec (redemarrage + tapotte sans arret sur la touche F8 desque l'ordi s'allume)

cherches et supprime les fichiers ou dossiers en gras :
C:\WINDOWS\system32\CTPMON.EXE  

ensuite execute ccleaner

a+++

bluesky6740 · Answer

Fixwareout 
Last edited 1/14/2006
Post this report in the forums please 
...
Prerun check
»»»»» HKLM run and Winlogon System values
C:\WINDOWS\system32\kdllf.exe will be moved to C:\WINDOWS	emp\kdllf.ren at reboot.
»»»»» System restarted
...
Reg Entries that were deleted 
...
Random Runs removed from HKLM 
...
 
PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
 
»»»»» Searching by size/names... 
 
»»»»» 
Search five digit cs, dm kd and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
 
Other suspects.
 
»»»»» Misc files. 
 
»»»»» Checking for older varients covered by the Rem3 tool.
 
»»»»» Postrun check 
»»»»» HKLM run 
»»»»» Winlogon System value
"system"=""
»»»»»

bluesky6740 · Answer

je ne comprends pas ;: ouvre hijack

salwa5 · Answer

ouvre hijack = double click sur le fichier hijackthis.exe


a++++

bluesky6740 · Answer

j'ai fais comme tu m'as dit  il est toujours là

bluesky6740 · Answer

je te laisse je dois y aller ,peut etre à  demain merci beaucoup salaw5 
a+

salwa5 · Answer

re :)  verifie si ce fichier kdllf.exe est present sur ton ordi

pour cela va dans le menu

demarrer/rechercher et tapes
kdllf.exe

supprime le et vide la corbeille ensuite remet un nouveau log hijackthis

a+++

Sinik6-0-9 · Answer

Salut salwa, comme tu es le seul a me répondre, je viens te demander, si tu as le temps de regarder mon post stp

Mon pc rame, et je voudrais bien que quelqu'un m'aide mais personne ne me répond ! merci d'avance

salwa5 · Answer

ok sinik je vais voir ce que je peu faire :p

a+++

Sinik6-0-9 · Answer

ah ben j'

salwa5 · Answer

bonjour repost un nouveau raport hijack stp

a+++

salwa5 · Answer

^bonjour ouvre hijackthis coche cette ligne puis click sur fix checked

O4 - HKCU\..\Run: [ctpmon] ctpmon.exe

redemare en mode sans echec (redemarrage + tapotte sans arret sur la touche F8 desque l'ordi s'allume)

cherches et supprime les fichiers ou dossiers en gras :

C:\WINDOWS\system32\ctpmon.exe

vide la corbeille

redemare en mode 

supprime les fichiers inutiles (fichiers temporaire , cookies .. ect avec ceci

Ccleaner
https://www.malekal.com/tutoriel-ccleaner/


redemare et dit moi ce que ca donne

a++++

salwa5 · Answer

bonjour tu es infecter par une nouvelle variante et pour  l'instant seul antivir peu la supprimer

donc telecharge antivir https://www.avira.com/

scan ton pc avec ensuite colle le resultat ici

 desactive ton antivirus pendant que antivir fait son travail , pour eviter tout risque de conflit


a++++

Séb08 · Answer

slt salwa,

je copie/colle le rapport . (doublon)

your computer is infected bluesky6740 (mercredi 24 janvier 2007 à 19:21:47) Statut Non résolu 
 
il me l'a mis sous quarantaine 

AntiVir PersonalEdition Classic 
Report file date: mercredi 24 janvier 2007 19:13 

Scanning for 569934 virus strains and unwanted programs. 

Licensed to: Avira AntiVir PersonalEdition Classic 
Serial number: 0000149996-ADJIE-0001 
Platform: Windows XP 
Windows version: (Service Pack 2) [5.1.2600] 
Username: ERIC 
Computer name: ERIC-D827EA99AB 

Version information: 
BUILD.DAT : 217 12749 Bytes 05/12/2006 17:00:00 
AVSCAN.EXE : 7.0.3.2 208936 Bytes 05/12/2006 15:30:07 
AVSCAN.DLL : 7.0.3.1 35880 Bytes 05/12/2006 16:00:22 
LUKE.DLL : 7.0.3.2 143400 Bytes 31/10/2006 16:07:46 
LUKERES.DLL : 7.0.2.0 9256 Bytes 05/12/2006 16:00:22 
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 15:30:06 
ANTIVIR1.VDF : 6.36.1.24 2212864 Bytes 14/11/2006 09:12:08 
ANTIVIR2.VDF : 6.36.1.113 221696 Bytes 01/12/2006 09:12:12 
ANTIVIR3.VDF : 6.37.0.3 6144 Bytes 01/12/2006 09:12:14 
AVEWIN32.DLL : 7.3.0.15 1982976 Bytes 04/12/2006 17:18:38 
AVPREF.DLL : 7.0.2.0 23592 Bytes 03/11/2006 10:53:44 
AVREP.DLL : 6.37.0.3 983080 Bytes 01/12/2006 09:05:52 
AVRPBASE.DLL : 7.0.0.0 2162728 Bytes 30/03/2006 08:43:31 
AVPACK32.DLL : 7.2.0.5 368680 Bytes 23/10/2006 15:21:31 
AVREG.DLL : 7.0.1.1 30760 Bytes 23/10/2006 10:52:27 
NETNT.DLL : No Information! 
RCIMAGE.DLL : 7.0.1.3 2097192 Bytes 08/11/2006 12:26:26 
RCTEXT.DLL : 7.0.12.1 77864 Bytes 05/12/2006 16:00:21 

Configuration settings for the scan: 
Jobname..........................: Windows System Directory 
Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\setupprf.dat 
Logging..........................: low 
Primary action...................: interactive 
Secondary action.................: ignore 
Scan master boot sector..........: off 
Scan boot sector.................: on 
Boot sectors.....................: C:, 
Scan memory......................: on 
Process scan.....................: on 
Scan registry....................: on 
Scan all files...................: Intelligent file selection 
Scan archives....................: on 
Recursion depth..................: 20 
Smart extensions.................: on 
Macro heuristic..................: on 
File heuristic...................: medium 

Start of the scan: mercredi 24 janvier 2007 19:13 

The scan of running processes will be started 
Scan process 'avscan.exe' - '1' Modules have been scanned 
Scan process 'msmsgs.exe' - '1' Modules have been scanned 
Scan process 'avgnt.exe' - '1' Modules have been scanned 
Scan process 'avguard.exe' - '1' Modules have been scanned 
Scan process 'sched.exe' - '1' Modules have been scanned 
Scan process 'iexplore.exe' - '1' Modules have been scanned 
Scan process 'svchost.exe' - '1' Modules have been scanned 
Scan process 'alg.exe' - '1' Modules have been scanned 
Scan process 'HPZipm12.exe' - '1' Modules have been scanned 
Scan process 'wdfmgr.exe' - '1' Modules have been scanned 
Scan process 'symlcsvc.exe' - '0' Modules have been scanned 
Scan process 'svchost.exe' - '1' Modules have been scanned 
Scan process 'StarWindService.exe' - '1' Modules have been scanned 
Scan process 'AluSchedulerSvc.exe' - '0' Modules have been scanned 
Scan process 'nvsvc32.exe' - '1' Modules have been scanned 
Scan process 'NPFMNTOR.EXE' - '0' Modules have been scanned 
Scan process 'NAVAPSVC.EXE' - '0' Modules have been scanned 
Scan process 'hpgs2wnf.exe' - '1' Modules have been scanned 
Scan process 'ctpmon.exe' - '1' Modules have been scanned 
Module is infected -> 'C:\WINDOWS\system32\ctpmon.exe' 
Scan process 'FSScrCtl.exe' - '1' Modules have been scanned 
Scan process 'ctpmon.exe' - '1' Modules have been scanned 
Module is infected -> 'C:\WINDOWS\system32\ctpmon.exe' 
Scan process 'MemOptimizer.exe' - '1' Modules have been scanned 
Scan process 'ctfmon.exe' - '1' Modules have been scanned 
Scan process 'NMBgMonitor.exe' - '1' Modules have been scanned 
Scan process 'LVCOMSX.EXE' - '1' Modules have been scanned 
Scan process 'hpgs2wnd.exe' - '1' Modules have been scanned 
Scan process 'jusched.exe' - '1' Modules have been scanned 
Scan process 'rundll32.exe' - '1' Modules have been scanned 
Scan process 'tlpd.exe' - '1' Modules have been scanned 
Scan process 'daemon.exe' - '1' Modules have been scanned 
Scan process 'CCAPP.EXE' - '0' Modules have been scanned 
Scan process 'hphmon05.exe' - '1' Modules have been scanned 
Scan process 'hpcmpmgr.exe' - '1' Modules have been scanned 
Scan process 'hpztsb09.exe' - '1' Modules have been scanned 
Scan process 'ADeck.exe' - '1' Modules have been scanned 
Scan process 'Anti-Blaxx.exe' - '1' Modules have been scanned 
Scan process 'fts.exe' - '1' Modules have been scanned 
Scan process 'PDVDServ.exe' - '1' Modules have been scanned 
Scan process 'spoolsv.exe' - '1' Modules have been scanned 
Scan process 'CCEVTMGR.EXE' - '0' Modules have been scanned 
Scan process 'explorer.exe' - '1' Modules have been scanned 
Scan process 'SPBBCSvc.exe' - '0' Modules have been scanned 
Scan process 'SNDSrvc.exe' - '0' Modules have been scanned 
Scan process 'CCSETMGR.EXE' - '0' Modules have been scanned 
Scan process 'svchost.exe' - '1' Modules have been scanned 
Scan process 'svchost.exe' - '1' Modules have been scanned 
Scan process 'svchost.exe' - '1' Modules have been scanned 
Scan process 'svchost.exe' - '1' Modules have been scanned 
Scan process 'svchost.exe' - '1' Modules have been scanned 
Scan process 'lsass.exe' - '1' Modules have been scanned 
Scan process 'services.exe' - '1' Modules have been scanned 
Scan process 'winlogon.exe' - '1' Modules have been scanned 
Scan process 'csrss.exe' - '1' Modules have been scanned 
Scan process 'smss.exe' - '1' Modules have been scanned 
Infected processes will be killed 
Process 'ctpmon.exe' will be killed 
Process 'ctpmon.exe' will be killed 
Infected Process 'ctpmon.exe' will be rescanned 
C:\WINDOWS\system32\ctpmon.exe 
[DETECTION] Contains suspicious code HEUR/Malware 
[INFO] The file was moved to '4627a24d.qua'! 
Infected Process 'ctpmon.exe' will be rescanned 

47 processes with 45 modules were scanned 

Start scanning boot sectors: 
Boot sector 'C:\' 
[NOTE] No virus was found! 

Starting to scan the registry. 

The registry was scanned ( 29 files ). 


Starting the file scan:

Configuration: Windows XP
Internet Explorer 6.0
 

a+ ;)

salwa5 · Answer

Merci Seb :) 

 bluesky ---- repost un nouveau hijack stp

a+++

salwa5 · Answer

bonsoir ouvre hijack coches ces lignes puis clic sur fix checked

O4 - HKCU\..\Run: [ctpmon] ctpmon.exe


sinon a part ca ton log est propre , as tu d'autre problemes?

a+++

salwa5 · Answer

bonjour , oui tu peu desinstaller antivir , ton log est propre 


pour finir quelque conseils de base :



* Ne pas telecharger n'importe quoi eviter les programes gratuit genre smileys ...ect

* Toujour analyser les  fichiers telecharger depuis un peer to peer (emule , kazza ... ect) avant de les executer

* Ne pas ouvrir les pieces jointes d'un expediteur inconnu et toujour les analysé avant de les ouvrir 

* Toujour analysé les fichiers recu via msn ou autre avec ton antivirus

* Ne pas cliqué sur des lien louche dans msn 

* Passe reglierement les antispyware (adaware , spybot , avg .. ect) pense a les mettre ajour avant de les lancé c'est tres important 

* Supprime regulierement les fichiers inutiles (fichiers temporaire , cookies .. ect) a l'aide de CCleaner https://www.malekal.com/tutoriel-ccleaner/ 

* Netoye ta base de registre avec regcleaner https://www.malekal.com/nettoyer-sa-base-de-registre-avec-windows-registry-cleaner/ 

* Utiliser le navigateur Mozzilla  il est plus sure http://www.mozilla-europe.org/fr/products/firefox/

-Maintenant que ton ordinateur est propre je te conseille de creer un point de restauration comme ca en cas de probleme (virus , plantage ..ect) tu poura tjr revenir en arriere 
http://www.aidoforum.com/tutoriaux-371-creer-un-point-de-restauration-sous-windows.html

a+++ 

Bon surf ;)

salwa5 · Answer

bonsoir :)  fix ces 2 lignes avec hijacthis et normalement t'aura plus de message d'erreur au demarrage

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe 

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" 


a+++++

salwa5 · Answer

De rien :)

a+++

jsm83 · Answer

J'ai le même problème de message "Your computer is infected"
J'ai fais un scan : 

Logfile of HijackThis v1.99.1
Scan saved at 17:44:16, on 07/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS.0\system32undll32.exe
C:\WINDOWS.0\system32\v6.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\WINDOWS.0\system32\ctpmon.exe
C:\WINDOWS.0\system32\ctpmon.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32
vsvc32.exe
C:\WINDOWS.0\system32\HPZipm12.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS.0\system32\WgaTray.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS.0\system32\mmc.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1.SWE\LOCALS~1\Temp\Rar$EX00.188\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fdivertissements.msn.fr%2fradio%2f%3f
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [syswin] C:\WINDOWS.0\system32\v6.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctpmon] ctpmon.exe
O4 - Startup: TribalWeb.net.lnk = E:\Program Files\TribalWeb.net	ribalweb.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: rpcc - C:\WINDOWS.0\system32pcc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS.0\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzzc32 - C:\WINDOWS.0\SYSTEM32\winzzc32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows.0\system32\msvcrtd.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS.0\system32\HPZipm12.exe

Merci de m'aider

salwa5 · Answer

bonjour si tu as le meme probleme donc fait les meme manip c'est a dire telecharge smitfraud choisi option 1 et colle le raport ici

a++++

jsm83 · Answer

Merci de t aréponse rapide, voici le rapport :
SmitFraudFix v2.127

Rapport fait à 18:17:40,03, 07/02/2007
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS.0


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS.0\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS.0\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS.0\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur.SWEET-6ACAFA4E3


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur.SWEET-6ACAFA4E3\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1.SWE\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

salwa5 · Answer

ok le raport est propre 

passe a l'etape 2 c'est a dire telecharge et execute antivir ( voir message numero 24)

a+++

Séb08 · Answer

slt vous deux , :)

Attention la version du fix est passée ...
Ce fichier C:\WINDOWS.0\system32\ctpmon.exe aurait du être viré.
Donc relance smitfraudfix et fais l'option 4 pour le mettre à jour ensuite refait l'option 1 et colle  le rapport.

Je te laisse la suite salwa. ;-)

a+

salwa5 · Answer

bonsoir Seb :) 

Attention la version du fix est passée ... 


c'est a dire?

a+++

salwa5 · Answer

ok merci pour l'info :)

a+++

jsm83 · Answer

Désolé, j en'avais pas vu votre réponse, j'ai terminé Antivir, voici le rapport
AntiVir PersonalEdition Classic
Report file date: mercredi 7 février 2007  19:48

Scanning for 665819 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         Administrateur
Computer name:    SWEET-6ACAFA4E3

Version information:
BUILD.DAT    : 217           12749 Bytes  05/12/2006 17:00:00
AVSCAN.EXE   : 7.0.3.5      208936 Bytes  07/02/2007 17:27:02
AVSCAN.DLL   : 7.0.3.1       35880 Bytes  05/12/2006 16:00:22
LUKE.DLL     : 7.0.3.2      143400 Bytes  31/10/2006 16:07:46
LUKERES.DLL  : 7.0.2.0        9256 Bytes  05/12/2006 16:00:22
ANTIVIR0.VDF : 6.35.0.1    7371264 Bytes  31/05/2006 15:30:06
ANTIVIR1.VDF : 6.37.0.153  3131392 Bytes  12/01/2007 17:27:03
ANTIVIR2.VDF : 6.37.1.37    495616 Bytes  05/02/2007 17:27:03
ANTIVIR3.VDF : 6.37.1.51     25600 Bytes  07/02/2007 17:27:03
AVEWIN32.DLL : 7.3.1.34    2290176 Bytes  07/02/2007 17:27:04
AVPREF.DLL   : 7.0.2.0       23592 Bytes  03/11/2006 10:53:44
AVREP.DLL    : 6.37.1.1    1105960 Bytes  07/02/2007 17:27:03
AVRPBASE.DLL : 7.0.0.0     2162728 Bytes  30/03/2006 08:43:31
AVPACK32.DLL : 7.2.0.5      368680 Bytes  23/10/2006 15:21:31
AVREG.DLL    : 7.0.1.2       30760 Bytes  07/02/2007 17:27:02
NETNT.DLL    : No Information!
RCIMAGE.DLL  : 7.0.1.3     2097192 Bytes  08/11/2006 12:26:26
RCTEXT.DLL   : 7.0.12.1      77864 Bytes  05/12/2006 16:00:21

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: L:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Expanded search settings.........: 0x00007000

Start of the scan: mercredi 7 février 2007  19:48

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Modules have been scanned
Scan process 'avcenter.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'wgatray.exe' - '1' Modules have been scanned
Scan process 'alg.exe' - '1' Modules have been scanned
Scan process 'ashWebSv.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'HPZipm12.exe' - '1' Modules have been scanned
Scan process 'nvsvc32.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'ashServ.exe' - '1' Modules have been scanned
Scan process 'aswUpdSv.exe' - '1' Modules have been scanned
Scan process 'avguard.exe' - '1' Modules have been scanned
Scan process 'sched.exe' - '1' Modules have been scanned
Scan process 'tribalweb.exe' - '1' Modules have been scanned
Scan process 'msnmsgr.exe' - '1' Modules have been scanned
Scan process 'ctfmon.exe' - '1' Modules have been scanned
Scan process 'avgnt.exe' - '1' Modules have been scanned
Scan process 'rundll32.exe' - '1' Modules have been scanned
Scan process 'ashDisp.exe' - '1' Modules have been scanned
Scan process 'spoolsv.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'explorer.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'lsass.exe' - '1' Modules have been scanned
Scan process 'services.exe' - '1' Modules have been scanned
Scan process 'winlogon.exe' - '1' Modules have been scanned
Scan process 'csrss.exe' - '1' Modules have been scanned
Scan process 'smss.exe' - '1' Modules have been scanned
33 processes with 33 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'D:\'
      [NOTE]      No virus was found!
Boot sector 'E:\'
      [NOTE]      No virus was found!
Boot sector 'F:\'
      [NOTE]      In the drive 'F:\' no data medium is inserted!
Boot sector 'G:\'
      [NOTE]      In the drive 'G:\' no data medium is inserted!
Boot sector 'H:\'
      [NOTE]      In the drive 'H:\' no data medium is inserted!
Boot sector 'I:\'
      [NOTE]      In the drive 'I:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( 13 files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\Administrateur.SWEET-6ACAFA4E3\Local Settings\Temp\mst75.tmp
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [INFO]      The file was moved to '463e2131.qua'!
C:\Documents and Settings\Administrateur.SWEET-6ACAFA4E3\Local Settings\Temp\Temporary Internet Files\Content.IE5\6XFYGGRL\functions.js[1].php
      [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.N
      [INFO]      The file was moved to '4638216e.qua'!
C:\Program Files\RegistryCleaner\RegistryCleaner.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '463128e4.qua'!
C:\WINDOWS\system32\bkd.exe
      [DETECTION] Contains signature of the dropper DR/SurfSide.AY
      [INFO]      The file was moved to '462e2cd3.qua'!
C:\WINDOWS.0\system32\autosys.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Harnig.AB.34
      [INFO]      The file was moved to '463e2e40.qua'!
C:\WINDOWS.0\system32\msvcrtd.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '46402e81.qua'!
C:\WINDOWS.0\system32\rpcc.dll
      [WARNING]   The file could not be opened!
C:\WINDOWS.0\system32\winzzc32.dll
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS.0\system32\drivers\dtscsi.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS.0\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS.0\system32\drivers\sptd4733.sys
      [WARNING]   The file could not be opened!
Begin scan in 'D:\'
D:\smilies\hbtools.exe
      [DETECTION] Contains signature of the dropper DR/Shopper.K
      [INFO]      The file was moved to '463e2f94.qua'!
Begin scan in 'E:\'
E:\RCT 2006-2007\Program Files\DeluxeCommunications\Dxc.exe
      [DETECTION] Is the Trojan horse TR/Agent.134656
      [INFO]      The file was moved to '462d315f.qua'!
E:\SAUVEGARDE C\Mes documents\Mes fichiers reçus\Dreamweaver.Trial.8.0.x.GENERiC_CRK-FFF.zip
  [0] Archive type: ZIP
  --> Crack.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '462f33c1.qua'!
Begin scan in 'F:\'
The path F:\ could not be found!
Le périphérique n'est pas prêt.

Begin scan in 'G:\'
The path G:\ could not be found!
Le périphérique n'est pas prêt.

Begin scan in 'H:\'
The path H:\ could not be found!
Le périphérique n'est pas prêt.

Begin scan in 'I:\'
The path I:\ could not be found!
Le périphérique n'est pas prêt.

Begin scan in 'J:\'
The path J:\ could not be found!
Le périphérique n'est pas prêt.

Begin scan in 'K:\'
The path K:\ could not be found!
Le périphérique n'est pas prêt.

Begin scan in 'L:\'
The path L:\ could not be found!
Le périphérique n'est pas prêt.



End of the scan: mercredi 7 février 2007  21:16
Used time:  1:27:25 min

The scan has been done completely.

   9659 Scanning directories
 539544 Files were scanned
     10 viruses and/or unwanted programs were found
      0 files were deleted
      0 files were repaired
      9 files were moved to quarantine
      0 files were renamed
      5 Files cannot be scanned
 539534 Files not concerned
   9510 Archives were scanned
      6 Warnings
    267 Notes

Le message Your computer is infected  a disparu
Vous êtes vraiment très efficace

Je vais refaire l'option 4 puis la une suivant vos conseils

Merci encore

wolfwhite · Answer

j ai resolu moi mon probleme grace a cette page voir la manip en bas
virus your pc is infected tcpipmon exe
(virus) your pc is infected ,+tcpipmon.exe

meun · Answer

bonjour
g lance le logiciel que vous avez dit FIX ET VOILA LE RAPPORT
Username "Owner" - 11/14/2007 23:21:31 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Successfully flushed the DNS Resolver Cache.


System was rebooted successfully. 
 
~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "System"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe"
"LiveMonitor"="C:\Program Files\MSI\Live Update 3\LMonitor.exe"
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1"
"ccApp"="\"C:\Program Files\Common Files\Symantec Shared\ccApp.exe\""
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe"
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe"
"CHotkey"="mHotkey.exe"
"ledpointer"="CNYHKey.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"%FP%012-L2TP fts.exe"="\"C:\Program Files\012Net\012Net-Cable dialer\fts.exe\""
"%FP%012-L2TP FWPortal.exe"="\"C:\Program Files\012Net\012Net-Cable dialer\FWPortal.exe\" -no_dialog"
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"
"NvMediaCenter"="RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit"
"RegistryMechanic"=""
"STUPID NEW GPL AIM"="C:\Documents and Settings\All Users\Application Data\Loud dart stupid new\window jugs.exe"
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE"
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe"
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe"
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\""
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe"
".nvsvc"="C:\WINDOWS\system\smbss.exe /w"
"BufferZone"="\"C:\Program Files\BufferZone\CLIENTGUI.EXE\" /STARTUP"
"stupid creative poll axis"="C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\error wait.exe"
"Explorer"="C:\WINDOWS\iexplorer.exe"
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup"
"devenv"="C:\WINDOWS\system\smvss.exe /w"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"MsnMsgr"="~\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe\""
"LogitechSoftwareUpdate"="\"C:\Program Files\Logitech\Video\ManifestEngine.exe\" boot"
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe"
"messengerskinner"="C:\Program Files\MessengerSkinner\MessengerSkinner.exe"
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe"
"bevdfge"="c:\windows\system32\bevdfge.exe bevdfge"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

salwa5 · Answer

bonjour 

Ouvre ce lien  (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php 
et télécharge SmitfraudFix.exe.

Regarde le tuto
Exécute le en choisissant l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.  


si l'infection est detecté : 

Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter. 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 
---------------------------------------------------------------------------- 
Relance le programme Smitfraud, 
Cette fois choisit l’option 2, répond oui a tous ; 
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum 


a++++

benos.hasnae · Answer

salam les amis(e) j'ai un probleme svp j'ai besoin de 'aide ?
quand j'ai essayé d'ouvrir mes partitions c-a-d partition de systeme et de donné mais j'ai pa reussi car quand je fait ouvrir o bien double click il me repond par ouvrir avec un programme specifié je sai ke c'est un virus mai je sai pa klk antivirus je doit choisir pour eviter le formatage svp j'ai besoin d'aide repondez svp si vous avez des proposition je serai ravi et merci d'avance

salwa5 · Answer

aparement les fichier autorun sont infecté 

telecharge kill_autorun_vbs.dat

http://www.monwebperso.info/modules.php?name=Downloads&d_op=getit&lid=16 

branche tout les disque externe et clée usb infecté 

desactive ton antivirus 

lance kill_autorun_vbs.dat 

redemare l'ordi et dit nous ce que ca donne

a+++

benos.hasnae · Answer

resalut merci salwa ca marche d'un seule coup merci beaucoup ; just je veux te questionner svp, c koi l problem ? estce ke le fichier autorun ki est endomager o bien un virus ? merci

salwa5 · Answer

en fait certain virus comme  Troj/RJump , se propage principalement par  disque amovible  , ils infecte les fichiers autorun et donc empeche l'ouverture des partiotion ou disque amovible par le double click 

pour plus d'info  lire ceci

http://forum.malekal.com/ftopic3350.php

a+++

Your computer is infected

38 réponses

Discussions similaires