[Virus] Infecté par Win32:Trojan-Gen

Grymander Messages postés 17 Statut Membre -  
 Utilisateur anonyme -
Bonsoir,

je suis infecté par ce virus et malgré toutes les recommandations et les différentes manières trouvées pour le supprimer, je n'y arrive pas.

Je suis sous WIN XP Pro, avec Avast!

Merci d'avance pour votre aide,

Cordialement,

Jérôme

PS : Je rajoute que mon repertoire c:\windows\temp\ est plein de fichiers win****.tmp, de plus les fichiers trouvés par Avast! sont des exe qui se trouve dans local settings\IE\Temp..... 

Configuration: Windows XP
Firefox 1.5.0.10

3 réponses

  1.
    Grymander Messages postés 17 Statut Membre
     
    Rebonsoir,
    Pour prendre un peu d'avance je vous joint le 1er rapport Hijackthis, puis le rapport après Vundo et enfin le rapport Hijackthis final...

    Logfile of HijackThis v1.99.1
    Scan saved at 22:18:06, on 04/03/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\WINDOWS\ATK0100\HControl.exe
    C:\WINDOWS\system32\ACEngSvr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\ATK0100\ATKOSD.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Foxmail\Foxmail.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\system32\WISPTIS.EXE
    C:\WINDOWS\system32\udial.exe
    C:\WINDOWS\system32\udial.exe
    C:\WINDOWS\system32\udial.exe
    C:\WINDOWS\system32\udial.exe
    C:\WINDOWS\system32\udial.exe
    C:\WINDOWS\system32\udial.exe
    C:\hijack\scan.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1A7EAC85-D474-EEE9-6CC6-0816F332E111} - C:\WINDOWS\system32\toxxhc.dll
    O2 - BHO: (no name) - {2EAFAB18-4F81-4A3E-AB26-F079F93B5F3E} - C:\WINDOWS\system32\geebx.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {9FF92BD1-ABE4-4879-9D06-C0983FD27A3D} - (no file)
    O2 - BHO: (no name) - {C84400A8-82F7-42C3-87F4-D1D67FE959D1} - C:\WINDOWS\system32\gebbawt.dll
    O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - C:\WINDOWS\system32\rxytrhdp.dll
    O2 - BHO: (no name) - {E0210C4D-DD73-4814-B749-50E1C7E9E049} - C:\WINDOWS\system32\geebx.dll
    O3 - Toolbar: (no name) - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
    O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
    O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geomapguide.com/aixenprovence/Cabs/mgaxctrl.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: gebbawt - C:\WINDOWS\SYSTEM32\gebbawt.dll
    O20 - Winlogon Notify: geebx - C:\WINDOWS\system32\geebx.dll
    O20 - Winlogon Notify: winmmt32 - C:\WINDOWS\SYSTEM32\winmmt32.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe
    0
  2. Grymander Messages postés 17 Statut Membre
     
    Re,

    voici le rapport Vundo et l'autre Hijack

    VundoFix V6.3.2

    Checking Java version...

    Sun Java not detected
    Scan started at 00:52:34 23/01/2007

    Listing files found while scanning....

    VundoFix V6.3.2

    Checking Java version...

    Sun Java not detected
    Scan started at 12:13:08 23/01/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\bcbeg.bak2
    C:\WINDOWS\system32\bcbeg.ini
    C:\WINDOWS\system32\fcccccc.dll
    C:\WINDOWS\system32\gebcb.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\bcbeg.bak2
    C:\WINDOWS\system32\bcbeg.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\bcbeg.ini
    C:\WINDOWS\system32\bcbeg.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\fcccccc.dll
    C:\WINDOWS\system32\fcccccc.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\gebcb.dll
    C:\WINDOWS\system32\gebcb.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\fcccccc.dll
    C:\WINDOWS\system32\fcccccc.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.3.2

    Checking Java version...

    Sun Java not detected
    Scan started at 12:11:53 24/01/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\iifecay.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\iifecay.dll
    C:\WINDOWS\system32\iifecay.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.3.2

    Checking Java version...

    Sun Java not detected
    Scan started at 09:34:44 27/01/2007

    Listing files found while scanning....

    No infected files were found.

    VundoFix V6.3.2

    Checking Java version...

    Sun Java not detected
    Scan started at 10:47:48 27/01/2007

    Listing files found while scanning....

    No infected files were found.

    VundoFix V6.3.12

    Checking Java version...

    Java version is 1.5.0.10

    Scan started at 22:34:36 04/03/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\asvnyopy.exe
    C:\WINDOWS\system32\atvxpstw.exe
    C:\WINDOWS\system32\bbjiocaq.dll
    C:\WINDOWS\system32\bbkdakhv.exe
    C:\WINDOWS\system32\bjnwfdlq.exe
    C:\WINDOWS\system32\ceqkkvak.exe
    C:\WINDOWS\system32\ehadakxr.dll
    C:\WINDOWS\system32\fdtudtgo.exe
    C:\WINDOWS\system32\gebbawt.dll
    C:\WINDOWS\system32\geebx.dll
    C:\WINDOWS\system32\hjiwyirs.dll
    C:\WINDOWS\system32\hmrfcwyf.exe
    C:\WINDOWS\system32\isxdtlub.exe
    C:\WINDOWS\system32\jxnhlgje.exe
    C:\WINDOWS\system32\kcpysgwb.dll
    C:\WINDOWS\system32\lirikjgn.exe
    C:\WINDOWS\system32\ltinbtbc.dll
    C:\WINDOWS\system32\mpiyjnay.exe
    C:\WINDOWS\system32\nrlbdpdt.exe
    C:\WINDOWS\system32\obexsyul.dll
    C:\WINDOWS\system32\ohclkaog.exe
    C:\WINDOWS\system32\ojdkxjbc.exe
    C:\WINDOWS\system32\onthejea.dll
    C:\WINDOWS\system32\oqfepdis.exe
    C:\WINDOWS\system32\pgkhqlcj.dll
    C:\WINDOWS\system32\pgqksdvv.exe
    C:\WINDOWS\system32\psernebb.dll
    C:\WINDOWS\system32\qeuvungu.exe
    C:\WINDOWS\system32\qkaxodpa.exe
    C:\WINDOWS\system32\rxytrhdp.dll
    C:\WINDOWS\system32\tpsvcuxy.dll
    C:\WINDOWS\system32\ujoqcnvq.dll
    C:\WINDOWS\system32\utuusudl.exe
    C:\WINDOWS\system32\winmmt32.dll
    C:\WINDOWS\system32\xbeeg.bak1
    C:\WINDOWS\system32\xbeeg.bak2
    C:\WINDOWS\system32\xbeeg.ini
    C:\WINDOWS\system32\xbeeg.ini2
    C:\WINDOWS\system32\xbeeg.tmp
    C:\WINDOWS\system32\xnklwwgs.dll
    C:\WINDOWS\system32\ycwiaghd.dll
    C:\WINDOWS\system32\ykvywduj.exe

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\asvnyopy.exe
    C:\WINDOWS\system32\asvnyopy.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\atvxpstw.exe
    C:\WINDOWS\system32\atvxpstw.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\bbjiocaq.dll
    C:\WINDOWS\system32\bbjiocaq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\bbkdakhv.exe
    C:\WINDOWS\system32\bbkdakhv.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\bjnwfdlq.exe
    C:\WINDOWS\system32\bjnwfdlq.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ceqkkvak.exe
    C:\WINDOWS\system32\ceqkkvak.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ehadakxr.dll
    C:\WINDOWS\system32\ehadakxr.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\fdtudtgo.exe
    C:\WINDOWS\system32\fdtudtgo.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\gebbawt.dll
    C:\WINDOWS\system32\gebbawt.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\geebx.dll
    C:\WINDOWS\system32\geebx.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hjiwyirs.dll
    C:\WINDOWS\system32\hjiwyirs.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hmrfcwyf.exe
    C:\WINDOWS\system32\hmrfcwyf.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\isxdtlub.exe
    C:\WINDOWS\system32\isxdtlub.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jxnhlgje.exe
    C:\WINDOWS\system32\jxnhlgje.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\kcpysgwb.dll
    C:\WINDOWS\system32\kcpysgwb.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\lirikjgn.exe
    C:\WINDOWS\system32\lirikjgn.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ltinbtbc.dll
    C:\WINDOWS\system32\ltinbtbc.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mpiyjnay.exe
    C:\WINDOWS\system32\mpiyjnay.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\nrlbdpdt.exe
    C:\WINDOWS\system32\nrlbdpdt.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\obexsyul.dll
    C:\WINDOWS\system32\obexsyul.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ohclkaog.exe
    C:\WINDOWS\system32\ohclkaog.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ojdkxjbc.exe
    C:\WINDOWS\system32\ojdkxjbc.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\onthejea.dll
    C:\WINDOWS\system32\onthejea.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\oqfepdis.exe
    C:\WINDOWS\system32\oqfepdis.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\pgqksdvv.exe
    C:\WINDOWS\system32\pgqksdvv.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qeuvungu.exe
    C:\WINDOWS\system32\qeuvungu.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qkaxodpa.exe
    C:\WINDOWS\system32\qkaxodpa.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rxytrhdp.dll
    C:\WINDOWS\system32\rxytrhdp.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\tpsvcuxy.dll
    C:\WINDOWS\system32\tpsvcuxy.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ujoqcnvq.dll
    C:\WINDOWS\system32\ujoqcnvq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\utuusudl.exe
    C:\WINDOWS\system32\utuusudl.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\winmmt32.dll
    C:\WINDOWS\system32\winmmt32.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xbeeg.bak1
    C:\WINDOWS\system32\xbeeg.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xbeeg.bak2
    C:\WINDOWS\system32\xbeeg.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xbeeg.ini
    C:\WINDOWS\system32\xbeeg.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xbeeg.ini2
    C:\WINDOWS\system32\xbeeg.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xbeeg.tmp
    C:\WINDOWS\system32\xbeeg.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xnklwwgs.dll
    C:\WINDOWS\system32\xnklwwgs.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ycwiaghd.dll
    C:\WINDOWS\system32\ycwiaghd.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ykvywduj.exe
    C:\WINDOWS\system32\ykvywduj.exe Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\gebbawt.dll
    C:\WINDOWS\system32\gebbawt.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    ____________________
    RAPPORT HIJACKTHIS
    _____________________
    Logfile of HijackThis v1.99.1
    Scan saved at 22:52:09, on 04/03/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Inventel\Gateway\wlancfg.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
    C:\WINDOWS\system32\ACEngSvr.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\WINDOWS\ATK0100\HControl.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\WINDOWS\system32\udial.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\ATK0100\ATKOSD.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\hijack\scan.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1A7EAC85-D474-EEE9-6CC6-0816F332E111} - C:\WINDOWS\system32\toxxhc.dll
    O2 - BHO: (no name) - {2EAFAB18-4F81-4A3E-AB26-F079F93B5F3E} - C:\WINDOWS\system32\geebx.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {9FF92BD1-ABE4-4879-9D06-C0983FD27A3D} - (no file)
    O2 - BHO: (no name) - {C84400A8-82F7-42C3-87F4-D1D67FE959D1} - C:\WINDOWS\system32\gebbawt.dll (file missing)
    O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - C:\WINDOWS\system32\rxytrhdp.dll (file missing)
    O2 - BHO: (no name) - {E0210C4D-DD73-4814-B749-50E1C7E9E049} - C:\WINDOWS\system32\geebx.dll (file missing)
    O3 - Toolbar: (no name) - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
    O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
    O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
    O4 - HKLM\..\Run: [UDial] C:\WINDOWS\system32/udial.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geomapguide.com/aixenprovence/Cabs/mgaxctrl.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe
    0
  3. Utilisateur anonyme
     
    Salut

    Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu..

    Puis recommence un scan avec Vundo et colle le rapport ici stp
    0

Discussions similaires

Problème avec "PUADIManager:Win32/OfferCore
Knaki -
bazfile -

3 réponses
Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
PUADlManager:Win32/OfferCore
tenmalade -
tenmalade -

2 réponses