Problême dut je pense à un/des Trojan(s) - Page 2

ok

tu as tout supprimé ?

@+

oui oui , tout supprimé , mais internet fonctionne toujours de manière étrange :)

ok

repost un hijack this stp

@+

voilà pour toi :

Logfile of HijackThis v1.99.1
Scan saved at 18:32:26, on 09/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Logiciels\Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
D:\Jeux\ff\SquareEnix\PlayOnlineViewer\pol.exe
D:\Logiciels\Teamspeak2_RC2\TeamSpeak.exe
D:\Jeux\ff\ff\SquareEnix\FINAL FANTASY XI\ap\ApRadar.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Alex\Bureau\celtic.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 cmicnfg3.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [mlnllthf] rundll32.exe "C:\DOCUME~1\Alex\LOCALS~1\Temp\syshaihos.nls" WLEntryPoint
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - D:\Jeux\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: pgbel - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

re,

passe a la version 7.0 de ie meme si tu as firefox :

internet explorer 6.0 = failles de securitées importantes

alors fais les mises a jour windows : tu veux la version 7.0

https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70

puis

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instales l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes :
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

Je te dis tous ca car j´aimerais que tu performes un scan entier de ta machine a l´aide d´antivir avec les reglages stipulés ci dessus et que tu post le rapport généré ici stp

@+

Un ami plein de bonne volonté est passé chez moi , et a commencé a supprimer des fichiers TEMP, tout en refusant tout les changements de registre via Spybot ...

On redémarre , et la 10 messages d'erreurs identiques apparaissent : RUNDLL : erreur de chargement de C:/docume~1/alex~1/loclas/temp/ntfgrdetq.dll

Je ne peux lancer quasi aucun programme sans recevoir se message , sauf BSplayer , Spybot via une liste de fichiers dans Spybot / include / cookies.sbi par exemple , le .exe traditionnel ne marche pas ... Et pour internet , firefox ne marche pas , IE non plus , sauf qd je le lance via Spytobt / aide / page d'acceuil ...

J'ai voulu formater , mais mon clavier marche lors de la page de ma carté mère , au démarage , il se désactive endant le boot sur le CD (lorsqu'il me demande d'appuyer sur une touche) et il se réactive une fois sous windows ...
Sous windows je recois le message d'erreur lorsque je veux lancer le Setup.exe du cd ... Je suis reelement paumé :)

Désolé de completement changer de probleme , mais je ne sais pas si c'est une suite de l'ancien , ou juste une fausse manip de mon bienveillant ami :)Configuration: Windows XP
Internet Explorer 7.0

(sinon le scan que tu demandais enfin je crois ) :

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.40, April 2008
Started On Wed Apr 09 20:18:26 2008

Quick Scan Results:
----------------
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\mlnllthf
Found virus: Worm:Win32/Locksky.gen!A in runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\mlnllthf
Found virus: Worm:Win32/Locksky.gen!A in file://C:\Documents and Settings\Alex\Local Settings\Temp\syshaihos.nls
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\ftoolsfq
Found virus: Worm:Win32/Locksky.gen!A in runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\ftoolsfq
Found virus: Worm:Win32/Locksky.gen!A in file://C:\WINDOWS\system32\timefsbqs.dll
Found virus: Worm:Win32/Locksky.gen!A in shellopencmd://HKLM\SOFTWARE\CLASSES\exefile\shell\open\command\\
Found virus: Worm:Win32/Locksky.gen!A in file://C:\Documents and Settings\Alex\Local Settings\Temp\ntfgrdetq.dll
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Found virus: Worm:Win32/Locksky.gen!A in autorun://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Found virus: Worm:Win32/Locksky.gen!A in file://C:\Documents and Settings\Alex\Local Settings\Temp\timealgas.dll
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Found virus: Worm:Win32/Locksky.gen!A in winlogontaskman://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Found virus: Worm:Win32/Locksky.gen!A in file://C:\WINDOWS\system32\seclkfqpk.nls

Quick Scan Removal Results
----------------
Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\mlnllthf
Operation succeeded !

Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\ftoolsfq
Operation succeeded !

Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Operation succeeded !

Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Operation succeeded !

Start 'remove' for runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\mlnllthf
Operation succeeded !

Start 'remove' for runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\ftoolsfq
Operation succeeded !

Start 'remove' for shellopencmd://HKLM\SOFTWARE\CLASSES\exefile\shell\open\command\\
Operation succeeded !

Start 'remove' for autorun://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Operation succeeded !

Start 'remove' for winlogontaskman://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Operation succeeded !

Start 'remove' for file://\\?\C:\WINDOWS\system32\timefsbqs.dll
Operation succeeded !

Start 'remove' for file://\\?\C:\WINDOWS\system32\seclkfqpk.nls
Operation was scheduled to be completed after next reboot.

Start 'remove' for file://\\?\C:\Documents and Settings\Alex\Local Settings\Temp\timealgas.dll
Operation succeeded !

Start 'remove' for file://\\?\C:\Documents and Settings\Alex\Local Settings\Temp\syshaihos.nls
Operation succeeded !

Start 'remove' for file://\\?\C:\Documents and Settings\Alex\Local Settings\Temp\ntfgrdetq.dll
Operation succeeded !

Results Summary:
----------------
For cleaning Worm:Win32/Locksky.gen!A, the system needs to be restarted.

Return code: 10
Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 09 20:19:04 2008

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.40, April 2008
Started On Wed Apr 09 20:19:05 2008

Quick Scan Results:
----------------
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\dgetrfgb
Found virus: Worm:Win32/Locksky.gen!A in runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\dgetrfgb
Found virus: Worm:Win32/Locksky.gen!A in file://C:\Documents and Settings\Alex\Local Settings\Temp\xmlgkmglf.nls
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\glmbndsp
Found virus: Worm:Win32/Locksky.gen!A in runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\glmbndsp
Found virus: Worm:Win32/Locksky.gen!A in file://C:\WINDOWS\system32\msxmliecs.nls
Found virus: Worm:Win32/Locksky.gen!A in shellopencmd://HKLM\SOFTWARE\CLASSES\exefile\shell\open\command\\
Found virus: Worm:Win32/Locksky.gen!A in file://C:\Documents and Settings\Alex\Local Settings\Temp\mcimgngg.nls
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Found virus: Worm:Win32/Locksky.gen!A in autorun://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Found virus: Worm:Win32/Locksky.gen!A in file://C:\Documents and Settings\Alex\Local Settings\Temp\wuajqiclt.drv
Found virus: Worm:Win32/Locksky.gen!A in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Found virus: Worm:Win32/Locksky.gen!A in winlogontaskman://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Found virus: Worm:Win32/Locksky.gen!A in file://C:\WINDOWS\system32\seclkfqpk.nls

Quick Scan Removal Results
----------------
Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\dgetrfgb
Operation succeeded !

Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\glmbndsp
Operation succeeded !

Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Operation succeeded !

Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Operation succeeded !

Start 'remove' for runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\dgetrfgb
Operation succeeded !

Start 'remove' for runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\glmbndsp
Operation succeeded !

Start 'remove' for shellopencmd://HKLM\SOFTWARE\CLASSES\exefile\shell\open\command\\
Operation succeeded !

Start 'remove' for autorun://HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN
Operation succeeded !

Start 'remove' for winlogontaskman://HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN
Operation succeeded !

Start 'remove' for file://\\?\C:\WINDOWS\system32\seclkfqpk.nls
Operation was scheduled to be completed after next reboot.

Start 'remove' for file://\\?\C:\WINDOWS\system32\msxmliecs.nls
Operation succeeded !

Start 'remove' for file://\\?\C:\Documents and Settings\Alex\Local Settings\Temp\xmlgkmglf.nls
Operation succeeded !

Start 'remove' for file://\\?\C:\Documents and Settings\Alex\Local Settings\Temp\wuajqiclt.drv
Operation succeeded !

Start 'remove' for file://\\?\C:\Documents and Settings\Alex\Local Settings\Temp\mcimgngg.nls
Operation succeeded !

Results Summary:
----------------
For cleaning Worm:Win32/Locksky.gen!A, the system needs to be restarted.

Return code: 10
Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 09 20:20:28 2008

tiens , la commande ctrl +c / ctrl + v ne marche apparement pas non plus :)

petit up , je ne vois plus mon post dans la première page :)

j´arrete
merci de trouver un autre helper

Bonjour,

je vais reprendre le topic.

Tu peux me remettre un rapport Hijackthis et me faire un bilan de tes problèmes. merci.