Sujet Précédent Sujet Suivant

Virus spyware-hot

lias19 Messages postés 5 Statut Membre -  
lias19 Messages postés 5 Statut Membre -
bonjour a ceux qui travail ici,je suis nouveau et comme tous j'essai de regler mes problemes,lol,donc voila mon probleme,mon ordi rame,et quand j'essai d'ouvrir des pages internet le lien est rarement le bon,en haut dans l'adresse il y a ecrit spyware-hot,voila si vous pouvez m'aider,merci
A voir également:

3 réponses

Réponse 1 / 3
salwa5 Messages postés 7552 Statut Contributeur 1 670
 
bonjour commence par telecharger hijackthis et colle le resultat ici :

http://www.infos-du-net.com/telecharger/HijackThis.html
demo :
http://pageperso.aol.fr/balltrap34/demohijack.htm

a+++
0
lias19 Messages postés 5 Statut Membre
 
bjr,donc voici le diagnostic de hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 16:19:35, on 13/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\WiFiCfg.exe
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\TOSHIBA\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [DVD43] "C:\Program Files\DVD Region+CSS Free\DVDRegionFree.exe" /hidden
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Shell] C:\WINDOWS\system\smsc.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: 802.11g USB 2.0 adapter Setting.lnk = C:\WINDOWS\system32\WiFiCfg.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{02671928-116B-4FF8-9F44-0CC79D0CF7E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{09792384-2141-4A71-B292-404F6A4B224F}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E0E6D96-F90F-4FAE-B129-57AA38BAC445}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{18B64E85-E798-42DD-B8E6-619A5C02AEDB}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{2680FEB9-EF94-4C5B-9B80-F645B10144B8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{532F5664-7B7C-406F-AE51-C39ABE92A6FB}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B3BF874-018C-4231-A58B-2AA89C6D51D0}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{65EFB3B8-1F64-4504-AB38-0AEE630D25E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{6705AD1B-7B63-448C-87E5-E078727BDBAA}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{814333A2-48A0-4DD2-8E99-D58A34C1A186}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C5973E9-84A4-4111-A50D-51392C9A177C}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{A44555C7-AF66-4AAE-8BD2-DE3168FCA9AF}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{A933747E-BDB3-45DA-972E-904B7EE140C4}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{AAC16364-1BFB-4D17-A0A0-24096E1CEB0C}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{B76DCB44-6ADA-4C12-B68F-A9634CEC2838}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{BC93AA8A-A1BF-45E7-BB0F-9CA8EA2C4617}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0FEB2E8-25FD-4620-AB1B-77E13B742722}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4C16C1F-3A2C-444A-90DB-432CFBEF23ED}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{CDFACCA0-EF6C-4733-8A84-CDBE0ED240A8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7843D9D-65A5-4EE8-A4D5-5CF342AD91E6}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{EECF9ACC-F8AE-4735-8FE8-514023A80BC1}: NameServer = 85.255.114.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CS1\Services\Tcpip\..\{02671928-116B-4FF8-9F44-0CC79D0CF7E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CS2\Services\Tcpip\..\{02671928-116B-4FF8-9F44-0CC79D0CF7E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

merci davance
0
Réponse 2 / 3
salwa5 Messages postés 7552 Statut Contributeur 1 670
 
bonjour

* Télécharge FixWareout d'un de ces deux sites sur le bureau:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt)

ouvre hijackthis coches ces lignes puis clic sur fix checked

O4 - HKLM\..\Run: [Shell] C:\WINDOWS\system\smsc.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O17 - HKLM\System\CCS\Services\Tcpip\..\{02671928-116B-4FF8-9F44-0CC79D0CF7E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{09792384-2141-4A71-B292-404F6A4B224F}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E0E6D96-F90F-4FAE-B129-57AA38BAC445}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{18B64E85-E798-42DD-B8E6-619A5C02AEDB}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{2680FEB9-EF94-4C5B-9B80-F645B10144B8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{532F5664-7B7C-406F-AE51-C39ABE92A6FB}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B3BF874-018C-4231-A58B-2AA89C6D51D0}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{65EFB3B8-1F64-4504-AB38-0AEE630D25E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{6705AD1B-7B63-448C-87E5-E078727BDBAA}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{814333A2-48A0-4DD2-8E99-D58A34C1A186}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C5973E9-84A4-4111-A50D-51392C9A177C}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{A44555C7-AF66-4AAE-8BD2-DE3168FCA9AF}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{A933747E-BDB3-45DA-972E-904B7EE140C4}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{AAC16364-1BFB-4D17-A0A0-24096E1CEB0C}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{B76DCB44-6ADA-4C12-B68F-A9634CEC2838}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{BC93AA8A-A1BF-45E7-BB0F-9CA8EA2C4617}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0FEB2E8-25FD-4620-AB1B-77E13B742722}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4C16C1F-3A2C-444A-90DB-432CFBEF23ED}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{CDFACCA0-EF6C-4733-8A84-CDBE0ED240A8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7843D9D-65A5-4EE8-A4D5-5CF342AD91E6}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{EECF9ACC-F8AE-4735-8FE8-514023A80BC1}: NameServer = 85.255.114.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CS1\Services\Tcpip\..\{02671928-116B-4FF8-9F44-0CC79D0CF7E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CS2\Services\Tcpip\..\{02671928-116B-4FF8-9F44-0CC79D0CF7E8}: NameServer = 85.255.114.23
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220

cherche et supprime le fichier en gras si present

C:\WINDOWS\system\smsc.exe

redemare le pc et dit moi ce que ca donne

a++++
0
Réponse 3 / 3
lias19 Messages postés 5 Statut Membre
 
alors voici le rapport de fixwareout
Fixwareout
Last edited 12/06/2006
Post this report in the forums please
...
Prerun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""

...
...
Reg Entries that were deleted
...

Random Runs removed from HKLM
...
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»
Search five digit cs, dm kd and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.
...
Postrun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""

...
0

Discussions similaires

Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
virus Artemis!
mabiche37 -
Malekal_morte- -

14 réponses
Message Apple virus !!
Souclik67 -
MPMP10 -

3 réponses