virus isamntr.exe help me Fermé

Question

Bonjour suis novice.J'ai une icone qui clignote ds ma barre tache en bas à droite alerte et lorsque je clique dessus j'ai une page internet pr site antispyware et pages acceuil a disparu.J'ai 5 virus( ISAMNTR.EXE  ISAMINI.EXE  IESUNINST.EXE  ISADD.DLL  IESPLUGIN.DLL que mon antivirus detecte mais ne supprime pas (bulgard et spyboot)Comment dois je proceder please pour nettoyer mon pc??Voici mon rapport hijackthis 
Logfile of HijackThis v1.99.1
Scan saved at 12:37:48, on 22/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\setrysvc.exe
C:\WINDOWS\System32\semwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\System Control Manager\edd.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\Program Files\Mobistar\Connection Manager\Wid.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32	askmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\user\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msi.com.tw
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.spylocked.com/default.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Video Access ActiveX Object\iesplugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Connection Manager.lnk = ?
O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.msi.com.tw
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Merci

philae83 · Answer

bonjour,

* Télécharge SmitfraudFix de S!Ri, balltrap34 et moe31

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

* Installe le à la racine de C
 
* double clic sur l'exe pour le décompresser et lancer le fix.
Utilisation ----- option 1 - Recherche :
* Double clique sur smitfraudfix.cmd 
* Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
* Poste le rapport ici
process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

----

fred1972 · Answer

suite virus isa...
Voici le rapport smitfraud:
SmitFraudFix v2.152

Rapport fait à 16:24:14,71, 22/03/2007
Executé à partir de C:\Documents and Settings\user\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\fyxkaah.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\user\Favoris

C:\DOCUME~1\user\Favoris\Online Security Test.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b292ec9f-a074-4115-8342-1f459702d8d2}"="characterizing"

[HKEY_CLASSES_ROOT\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}\InProcServer32]
@="C:\WINDOWS\system32\fyxkaah.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}\InProcServer32]
@="C:\WINDOWS\system32\fyxkaah.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


VOICI RAPPORT DE MON ANTIVIRUS BULGARD APRES ANALYSE

BullGuard Scan Report
Scan Profile: "Poste de travail"
___________________________________________________________


----[  System Info  ]------------

OS Version:	Microsoft Windows XP Home Edition - Service Pack 2 (Build 2600) [1 * x86 CPUs] 
Physical memory:	960 MB
System up-time:	0 days, 00 hours, 54 minutes, 27 seconds
BullGuard up-time:	0 days, 00 hours, 53 minutes, 31 seconds
TopLayer Version:	6, 1, 0, 2
FileSpy5 Version:	1.0.11 built by: WinDDK
BdFileSpy Version:	N/A
FileSpy svc Version:	6, 1, 0, 5
Reconn Version:	N/A
MailProxy Version:	6, 1, 0, 5
AntiVirus Version:	6, 1, 0, 12

----[  Scan Parameters  ]------------

Folders to scan:
    C:\
    D:\

Excluded folders:
    None

Files to scan:
    None

Scan type:
    [o] Scan all files
    [ ] Scan program files only
    [ ] Scan custom extensions: 

    [X] Exclude user extensions: lnk

    [X] Scan boot sectors
    [X] Scan packed files
    [X] Scan archives
    [X] Scan emails
    [X] Enable heuristic detection

    [ ] Scan default action
___________________________________________________________

Scan Statistics
___________________________________________________________

Scan started:	Thursday, March 22, 2007 13:22:25
Scan duration:	0 days, 00 hours, 52 minutes, 42 seconds
Completion status:	Successful

Total files scanned:	388247
Total files skipped:	62
Identified viruses:	5
Scan speed:	122.79 files/sec

Files skipped:
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat [Open Failed]
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG [Open Failed]
    C:\Documents and Settings\LocalService\NTUSER.DAT [Open Failed]
    C:\Documents and Settings\LocalService
tuser.dat.LOG [Open Failed]
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat [Open Failed]
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG [Open Failed]
    C:\Documents and Settings\NetworkService\NTUSER.DAT [Open Failed]
    C:\Documents and Settings\NetworkService
tuser.dat.LOG [Open Failed]
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat [Open Failed]
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG [Open Failed]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>Ad-Aware SE Default.skn [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>arrow1.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>arrow2.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bck1.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt11.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt12.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt13.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt21.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt22.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt23.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt31.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt32.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt33.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt41.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt42.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt43.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt51.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt52.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt53.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt61.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>bt62.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>checkbox1.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>checkbox2.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>checkbox3.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>checkbox4.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>defbtn1.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>defbtn2.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>defbtn3.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>glyph1.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>glyph2.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>glyph3.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>glyph4.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>glyph5.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>glyph6.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>glyph7.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>main.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>preview.bmp [Password protected]
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\SNHB6MBP\aawsepersonal[1].exe=>wise0021=>sprite1.bmp [Password protected]
    C:\Documents and Settings\user
tuser.dat [Open Failed]
    C:\Documents and Settings\user
tuser.dat.LOG [Open Failed]
    C:\System Volume Information\MountPointManagerRemoteDatabase [Open Failed]
    C:\WINDOWS\system32\config\default [Open Failed]
    C:\WINDOWS\system32\config\default.LOG [Open Failed]
    C:\WINDOWS\system32\config\SAM [Open Failed]
    C:\WINDOWS\system32\config\SAM.LOG [Open Failed]
    C:\WINDOWS\system32\config\SECURITY [Open Failed]
    C:\WINDOWS\system32\config\SECURITY.LOG [Open Failed]
    C:\WINDOWS\system32\config\software [Open Failed]
    C:\WINDOWS\system32\config\software.LOG [Open Failed]
    C:\WINDOWS\system32\config\system [Open Failed]
    C:\WINDOWS\system32\config\system.LOG [Open Failed]
    D:\System Volume Information\MountPointManagerRemoteDatabase [Open Failed]

___________________________________________________________

Infected Files
___________________________________________________________

----[  Infected Files  ]------------

Virus:	Trojan.Downloader.Zlob.ZQT
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isadd.dll
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamini.exe
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamntr.exe

Virus:	Trojan.Downloader.Zlob.ZQU
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesplugin.dll

Virus:	Trojan.Downloader.Zlob.ZQV
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesuninst.exe

Virus:	Trojan.Downloader.Zlob.ZQW
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmunst.exe

Virus:	Trojan.Downloader.Zlob.ZQX
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmmnt.exe

___________________________________________________________

Results after ROUND 0
___________________________________________________________

Scan started:	Thursday, March 22, 2007 13:22:25
Scan duration:	0 days, 00 hours, 52 minutes, 42 seconds
Infections solved:	0
Infections left:	7
Viruses left:	5

----[  Files Still Infected  ]------------

Virus:	Trojan.Downloader.Zlob.ZQT
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isadd.dll
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamini.exe
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamntr.exe

Virus:	Trojan.Downloader.Zlob.ZQU
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesplugin.dll

Virus:	Trojan.Downloader.Zlob.ZQV
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesuninst.exe

Virus:	Trojan.Downloader.Zlob.ZQW
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmunst.exe

Virus:	Trojan.Downloader.Zlob.ZQX
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmmnt.exe

___________________________________________________________

Results after ROUND 1
___________________________________________________________

Scan started:	Thursday, March 22, 2007 14:49:56
Scan duration:	0 days, 00 hours, 00 minutes, 00 seconds
Infections solved:	0
Infections left:	7
Viruses left:	5

----[  Files Still Infected  ]------------

Virus:	Trojan.Downloader.Zlob.ZQT
Status:		Disinfect Failed
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isadd.dll
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamini.exe
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamntr.exe

Virus:	Trojan.Downloader.Zlob.ZQU
Status:		Disinfect Failed
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesplugin.dll

Virus:	Trojan.Downloader.Zlob.ZQV
Status:		Disinfect Failed
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesuninst.exe

Virus:	Trojan.Downloader.Zlob.ZQW
Status:		Disinfect Failed
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmunst.exe

Virus:	Trojan.Downloader.Zlob.ZQX
Status:		Disinfect Failed
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmmnt.exe

___________________________________________________________

Results after ROUND 2
___________________________________________________________

Scan started:	Thursday, March 22, 2007 14:50:08
Scan duration:	0 days, 00 hours, 00 minutes, 00 seconds
Infections solved:	7
Infections left:	0
Viruses left:	0

----[  Files Solved  ]------------

Virus:	Trojan.Downloader.Zlob.ZQT
Status:		Moved To Quarantine
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isadd.dll
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamini.exe
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\isamntr.exe

Virus:	Trojan.Downloader.Zlob.ZQU
Status:		Moved To Quarantine
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesplugin.dll

Virus:	Trojan.Downloader.Zlob.ZQV
Status:		Moved To Quarantine
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\iesuninst.exe

Virus:	Trojan.Downloader.Zlob.ZQW
Status:		Moved To Quarantine
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmunst.exe

Virus:	Trojan.Downloader.Zlob.ZQX
Status:		Moved To Quarantine
    C:\RECYCLER\S-1-5-21-3824822333-3227673675-1234450408-500\Dc1\pmmnt.exe

Merci d'etre explicite car suis novice.
En Vous remerciant de l'aide
Coordialement

philae83 · Answer

re

c'est le rapport de scan de quoi stp ? le 2 ème rapport ?

on continue

Maintenant :

Utilisation ----- option 2 -Nettoyage :

* Redémarre l'ordinateur en mode sans échec
(tapoter F8 au boot pour obtenir le menu de démarrage ou http://service1.symantec.com/support/inter/tsgeninfointl.nsf/fr_docid/20020905112131924


* Double clique sur smitfraudfix.cmd


* Sélectionne 2 pour supprimer les fichiers responsables de l'infection.


A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

Le fix déterminera si le fichier wininet.dll est infecté.

A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

* Redémarre en mode normal et poste le rapport ici

N.B.: Cette étape élimine les fichiers infectieux détectés à l'étape #1
Attention que l'option 2 de l'outil supprime le fond d'écran !

fred1972 · Answer

c'est le scan de mon antivirus bulgard

fred1972 · Answer

voici le scan smithfraud:
SmitFraudFix v2.152

Rapport fait à 17:26:29,21, jeu. 22/03/2007
Executé à partir de C:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Sorry pour t'avoir baladé apres moi...lol

philae83 · Answer

ok merci,

on reste ici maintenant :)

* télécharge AVG Anti-Spyware (ewido)

https://www.avg.com/en-ww/free-antivirus-download

* tu l'installes

* lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente

puis

Lance AVG Anti-Spyware

Clique sur le bouton Analyse (de la barre d'outils)

puis fait dans l'ordre stp. Tu sauvegardes le rapport APRES avoir mis les actions.

Puis sur l'onglet Paramètres,
sous : "Comment réagir "clique sur Actions recommandées. Sélectionne Quarantaine.

Reviens à l'onglet Analyse. Clique sur Analyse complète du système.

A la fin du scan, choisis l'option 3

"Appliquer toutes les actions " en bas.

Clique sur "Enregistrer le rapport".

Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.

Poste le.

fred1972 · Answer

je suis la et toi t'es partis?
Je reste sur ce topic.

fred1972 · Answer

tjs la en attente de la fin du scanning

fred1972 · Answer

je suis sur mon post principal.J'ai scanné tout avec avg et maintenant que dois je faire?

fred1972 · Answer

plus personnes pour m aider?

philae83 · Answer

re

je t'ai dit tout à l'heure

ok, je t'ai mis de nouvelles instructions, je reviendrais plus tard dan sla soirée maintenant

peut être que de tps en tps, je vis un peu en dehors des forums ....

tu as fait le scan avec AVG, mais le rapport tu l'as posté où ?

Virus isamntr.exe help me

11 réponses

Discussions similaires