Infected by trojan.peacomm virus

Solved

dine42 Posted messages 87 Status Member -
salwa5 Posted messages 7552 Status Contributor - 26 Jan 2007 at 21:32

Hello everyone,
I am new to the forum and I've been having an issue for 2 days: I am infected with the trojan.peacomm virus and I don't know how to get rid of it. Thank you for your help. I would also like to know if I should make a boot CD for my computer before any intervention regarding the removal of this virus. Thank you very much.

Configuration: Windows XP Internet Explorer 7.0

6 answers

Answer 1 / 6
salwa5 Posted messages 7552 Status Contributor 1 671

Hello, if you have Norton, go to this site http://www.symantec.com/avcenter/download/pages/FR-N95.html

and download this file 20070125-032-i32.exe

run it and let us know what happens

cya+++
0
1. dine42 Posted messages 87 Status Member 7
  
  Thank you for your advice, but my issue is that I previously had Norton Security and unfortunately, due to negligence, I did not renew my subscription and now I regret it because I caught this virus.
  I have surfed a bit on the forum to find some solutions but apparently, I need the HijackThis report, so here it is:
  Logfile of HijackThis v1.99.1
  Scan saved at 15:41:00, on 26/01/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5730.0011)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Norton Internet Security\ISSVC.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\System32\FTRTSVC.exe
  C:\Program Files\Parental Control\bin\optproxy.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\wdfmgr.exe
  c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\Program Files\Java\jre1.5.0\bin\jusched.exe
  C:\windows\system\hpsysdrv.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\ALCWZRD.EXE
  C:\WINDOWS\ALCMTR.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\HP\KBD\KBD.EXE
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG05.EXE
  C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
  C:\Documents and Settings\Compaq_Owner\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail?u=http%253A//webmail22c.orange.fr/webmail/fr_FR/inbox.html%253Fdub%253D2%2526FromSubmit%253Dtrue
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
  O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
  O4 - HKLM\..\Run: [Shortcut to the High Definition Audio Properties Page] HDAShCut.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe InternetManager.exe
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - Global Startup: AOL 9.0 AOL Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
  O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
  O4 - Global Startup: Quick Launch of Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
  O9 - Extra 'Tools' menuitem: Java Console (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
  O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
  O9 - Extra button: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messenger.exe
  O9 - Extra 'Tools' menuitem: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messenger.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{B12FB37D-DF93-4A81-926E-972F594592D9}: NameServer = 80.10.246.5 80.10.246.136
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Parental Control (OPTENET_FILTER) - Parental Control - C:\Program Files\Parental Control\bin\optproxy.exe
  O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  
  Thank you very much for any help you can provide.
  
  0
Answer 2 / 6
salwa5 Posted messages 7552 Status Contributor 1 671

Hello, if I understood correctly, you downloaded the file from this site http://www.symantec.com/avcenter/download/pages/FR-N95.html but you can't run it because your Norton license has expired?

See you later!
0
1. dine42 Posted messages 87 Status Member 7
  
  No, in the end, when I first asked for an internet connection from Orange, I already had Norton, and since November 11, 2006, I am no longer protected. To be honest, my computer knowledge is very limited, and maybe I'm not explaining myself well. Do you think that after the protection period expires, we still remain protected?
  I'm going to check the link you gave me right away.
  I’ll keep you updated.
  Thank you very much.
  
  0
Answer 3 / 6
salwa5 Posted messages 7552 Status Contributor 1 671

ok keep me posted if the link doesn't work uninstall Norton and install Avast

Avast (antivirus)
https://www.clubic.com/telecharger-fiche11113-avast-antivirus-gratuit.html

tutorial
https://forums.cnetfrance.fr

scan your PC with it and delete any found viruses

c+++
0
1. dine42 Posted messages 87 Status Member 7
  
  It's all good, the download worked!!
  I no longer have any alerts!!!
  Thank you very much for all your help.
  I'm super happy!!
  Have a great weekend!
  
  0
Answer 4 / 6
salwa5 Posted messages 7552 Status Contributor 1 671

You're welcome :) Renew your Norton subscription to benefit from real-time protection; otherwise, uninstall Norton and install another antivirus like Avast, for example.

To finish, here are some basic tips:

* Do not download just anything; avoid free programs like smileys, etc.

* Always scan files downloaded from peer-to-peer (eMule, Kazaa, etc.) before executing them.

* Do not open attachments from unknown senders and always scan them before opening.

* Always scan files received via MSN or other platforms with your antivirus.

* Do not click on suspicious links in MSN.

* Regularly run anti-spyware (Adaware, Spybot, AVG, etc.) and remember to update them before running; this is very important.

* Regularly delete unnecessary files (temporary files, cookies, etc.) using CCleaner https://www.malekal.com/tutoriel-ccleaner/

* Use the Mozilla browser; it's more secure <http: />

-Now that your computer is clean, I suggest creating a restore point so that in case of problems (virus, crash, etc.), you can always go back.
http://www.aidoforum.com/tutoriaux-371-creer-un-point-de-restauration-sous-windows.html

Happy surfing ;)
a+++
0
1. dine42 Posted messages 87 Status Member 7
  
  Last little question to avoid making a MISTAKE, can you give me the steps to follow to uninstall Norton and install Avast??
  Thanks for your help.
  
  0
Answer 5 / 6
dine42 Posted messages 87 Status Member 7

OK lesson well received!!
And thank you again, it's really nice.
To save on costs, I will uninstall Norton and install Avast.
Thanks a thousand times again!!
Have a good evening
0
Answer 6 / 6
salwa5 Posted messages 7552 Status Contributor 1 671

Good evening

go to the Control Panel >> Add/Remove Programs, and uninstall/remove:

everything related to Norton and Symantec

see you+++
0

Infected by trojan.peacomm virus

6 answers

Electronic invoicing

Rakuten and the -20%/month rate

Wrong email address twice

G502 x mouse does not charge on powerplay

Code pin invalide

Trackpad stuck

Persistent anchoring

Lost password

How to remove the justitsrch search engine from pc

Chpisir usb key formatting mode on bbox tv sensation?