Hklm\system\currentcontrolset\services\asc355

Résolu

circa901 Messages postés 45 Statut Membre -
circa901 Messages postés 45 Statut Membre - 21 juil. 2008 à 16:20

Bonjour,

que dois-je faire avec sa hklm\system\currentcontrolset\services\asc3550p c'est spyware terminator qui me le trouve a chaque scan alor que je le supprime toute les fois merci voici un rapport de hijackthis j'ai xp pro :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:40:59, on 2008-07-08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Spyware Terminator\SpywareTerminator.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 3001 bytes

Merci d'avance

Configuration: Windows XP
Firefox 3.0

Afficher la suite

A voir également:

Hklm system
Reboot system now - Guide
System ninja - Télécharger - Nettoyage
System fan 90b - Forum Refroidissement
Mail delivery system ✓ - Forum Virus
Avira rescue system - Télécharger - Antivirus & Antimalwares

9 réponses

Réponse 1 / 9
E..T Messages postés 6565 Statut Contributeur 437

Supprime ta version de hijack correctement redémarre un coup ton PC et ensuite

Clique sur ce lien
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
pour télécharger le fichier d'installation d'HijackThis.

Enregistre HJTInstall.exe sur ton bureau.

Double-clique sur HJTInstall.exe pour lancer le programme

Accepte en cliquant sur le bouton "I Accept"

Ensuite clique sur "do a system scan and save a logfile" et postes le rapport obtenu ici.

@++
1
1. circa901 Messages postés 45 Statut Membre
  
  Voici ce que ca me donne
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 15:40:30, on 2008-07-16
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16674)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\S24EvMon.exe
  C:\WINDOWS\system32\acs.exe
  C:\WINDOWS\system32\brsvc01a.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\brss01a.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\1XConfig.exe
  C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\WINDOWS\system32\Brmfrmps.exe
  C:\Program Files\Microsoft LifeCam\MSCamS32.exe
  C:\Program Files\Spyware Terminator\sp_rsser.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\PROGRA~1\Crawler\CToolbar.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
  R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
  O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
  O2 - BHO: adzgalore - {8219ae88-e017-49d4-6bfe-4b1b6f6b0baa} - C:\WINDOWS\system32\nsu138.dll
  O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
  O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
  O8 - Extra context menu item: Crawler Search - tbr:iemenu
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
  O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
  O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
  O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
  O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
  
  0
Réponse 2 / 9
circa901 Messages postés 45 Statut Membre

Bonjour,

Est-ce que quelqu'un peut m'aide mon spyware détecte toujours ce registry

merci !
0
Réponse 3 / 9
E..T Messages postés 6565 Statut Contributeur 437

Salut avec le rapport hijack complet ça serait mieux ;-)
++
0
1. circa901 Messages postés 45 Statut Membre
  
  Bonjour,
  
  Comment je dois faire pour le rapport complet
  
  Merci
  
  0
Réponse 4 / 9
E..T Messages postés 6565 Statut Contributeur 437

Bonsoir,
Fais ce qui suit :

* Télécharge MalwareByte's Anti-Malware (by RubbeR DuckY) :
*http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
* Installe le programme sur le bureau :

o S'il manque le fichier COMCTL32.OCX, télécharge le ici

* Fais les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)

* Démarre en mode sans échec

* Lance le MalwareByte's Anti-Malware, clique sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs

* Une fois le scan terminé, clique sur supprimer (si un message te demande de redémarrer le PC, accepte.)

* Un rapport sera généré, enregistre le de manière à le retrouver et poste le ici.

@++
0
1. circa901 Messages postés 45 Statut Membre
  
  Bonjour,
  
  voici le rapport que j'ai enregistrer
  
  Merci d'avance
  
  Malwarebytes' Anti-Malware 1.20
  Database version: 960
  Windows 5.1.2600 Service Pack 3
  
  14:57:38 2008-07-16
  mbam-log-7-16-2008 (14-57-38).txt
  
  Scan type: Full Scan (C:\|D:\|)
  Objects scanned: 76733
  Time elapsed: 45 minute(s), 28 second(s)
  
  Memory Processes Infected: 0
  Memory Modules Infected: 0
  Registry Keys Infected: 10
  Registry Values Infected: 1
  Registry Data Items Infected: 0
  Folders Infected: 2
  Files Infected: 59
  
  Memory Processes Infected:
  (No malicious items detected)
  
  Memory Modules Infected:
  (No malicious items detected)
  
  Registry Keys Infected:
  HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adzgalore (Adware.Agent) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cpmsky (Adware.Agent) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\asc3550p (Rootkit.Agent) -> Quarantined and deleted successfully.
  
  Registry Values Infected:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{826a5ed9-1316-4efd-87f8-aa400c5d551a} (Trojan.Vundo) -> Quarantined and deleted successfully.
  
  Registry Data Items Infected:
  (No malicious items detected)
  
  Folders Infected:
  C:\WINDOWS\system32smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  
  Files Infected:
  C:\WINDOWS\system32smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Program Files\Mozilla Firefox\components\nsBrowserGal.dll (Adware.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\{4574c23b-5a78-9628-cf81-5ab066177138}.dll-uninst.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\adzgalore-remove.exe (Adware.BHO) -> Quarantined and deleted successfully.
  C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32akttzn.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32anticipator.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32awtoolb.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32bdn.com (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32bsva-egihsg52.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32dpcproxy.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32emesx.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32h@tkeysh@@k.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32hoproxy.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32hxiwlgpm.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32hxiwlgpm.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32medup012.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32medup020.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32msgp.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32msnbho.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32mssecu.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32msvchost.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32mtr2.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32mwin32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32netode.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32newsd32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32ps1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32psof1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32psoft1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32regc64.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32regm64.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32Rundl1.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32sncntr.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32ssurf022.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32ssvchost.com (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32ssvchost.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32sysreq.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32taack.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32taack.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32temp#01.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32thun.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32thun32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32VBIEWER.OCX (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32vbsys2.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32vcatchpi.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32winlogonpc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\System32WINWGPX.EXE (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\WINDOWS\Web\def.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\drivers\asc3550p.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
  
  0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 5 / 9
E..T Messages postés 6565 Statut Contributeur 437

Désinstalle >> C:\PROGRA~1\Crawler\CToolbar.exe
Dans ajouts et suppression de programmes désinstalle la toolbar.
Et poste un nouveau rapport hijack.

@+
0
1. circa901 Messages postés 45 Statut Membre
  
  Bonjour,
  
  Voici le nouveau hijack
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 08:02:00, on 2008-07-17
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16674)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\S24EvMon.exe
  C:\WINDOWS\system32\acs.exe
  C:\WINDOWS\system32\brsvc01a.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\brss01a.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\1XConfig.exe
  C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\WINDOWS\system32\Brmfrmps.exe
  C:\Program Files\Microsoft LifeCam\MSCamS32.exe
  C:\Program Files\Spyware Terminator\sp_rsser.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
  O2 - BHO: adzgalore - {8219ae88-e017-49d4-6bfe-4b1b6f6b0baa} - C:\WINDOWS\system32\nsu138.dll
  O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
  O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
  O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
  O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
  
  0
Réponse 6 / 9
E..T Messages postés 6565 Statut Contributeur 437

Bonsoir
Repasse un de Malwarebytes' Anti-Malware message 4
Poste le rapport

Et ensuite
Télécharge maintenant Navilog1 depuis-ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, Fais un Clic-droit sur le raccourci Navilog présent sur ton bureau et choisis "Exécuter en tant qu'administrateur".

Au menu principal, Fais le choix 1
Laisse toi guider et patiente.
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche le bloc note va s'ouvrir.
Copie-colle l'intégralité du rapport ici.

@+
0
1. circa901 Messages postés 45 Statut Membre
  
  bonjour
  
  voici le nouveau malaware
  
  Malwarebytes' Anti-Malware 1.20
  Version de la base de données: 960
  Windows 5.1.2600 Service Pack 3
  
  08:18:30 2008-07-18
  mbam-log-7-18-2008 (08-18-30).txt
  
  Type de recherche: Examen complet (C:\|)
  Eléments examinés: 77979
  Temps écoulé: 49 minute(s), 5 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 19
  Valeur(s) du Registre infectée(s): 2
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 0
  Fichier(s) infecté(s): 0
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\aldd (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
  
  Valeur(s) du Registre infectée(s):
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  Fichier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  merci
  
  0
2. circa901 Messages postés 45 Statut Membre
  
  Bonjour,
  
  voici le rapport navilog
  
  Search Navipromo version 3.6.0 commencé le 2008-07-18 à 8:24:54,33
  
  !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
  !!! Postez ce rapport sur le forum pour le faire analyser !!!
  !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
  
  Outil exécuté depuis C:\Program Files\navilog1
  Session actuelle : "1"
  
  Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO
  
  Microsoft Windows XP [version 5.1.2600]
  Internet Explorer : 7.0.5730.13
  Système de fichiers : NTFS
  
  Recherche executé en mode normal
  
  *** Recherche Programmes installés ***
  
  *** Recherche dossiers dans "C:\WINDOWS" ***
  
  *** Recherche dossiers dans "C:\Program Files" ***
  
  *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***
  
  *** Recherche dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***
  
  *** Recherche dossiers dans "C:\Documents and Settings\1\applic~1" ***
  
  *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***
  
  *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.CLI\applic~1" ***
  
  *** Recherche dossiers dans "C:\Documents and Settings\1\locals~1\applic~1" ***
  
  *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***
  
  *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.CLI\locals~1\applic~1" ***
  
  *** Recherche dossiers dans "C:\Documents and Settings\1\menudm~1\progra~1" ***
  
  *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***
  
  *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.CLI\menudm~1\progra~1" ***
  
  *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
  pour + d'infos : http://www.gmer.net
  
  Aucun Fichier trouvé
  
  *** Recherche avec GenericNaviSearch ***
  !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
  !!! A vérifier impérativement avant toute suppression manuelle !!!
  
  * Recherche dans "C:\WINDOWS\system32" *
  
  * Recherche dans "C:\Documents and Settings\1\locals~1\applic~1" *
  
  * Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *
  
  * Recherche dans "C:\DOCUME~1\ADMINI~1.CLI\locals~1\applic~1" *
  
  *** Recherche fichiers ***
  
  *** Recherche clés spécifiques dans le Registre ***
  
  *** Module de Recherche complémentaire ***
  (Recherche fichiers spécifiques)
  
  1)Recherche nouveaux fichiers Instant Access :
  
  2)Recherche Heuristique :
  
  * Dans "C:\WINDOWS\system32" :
  
  * Dans "C:\Documents and Settings\1\locals~1\applic~1" :
  
  * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :
  
  * Dans "C:\DOCUME~1\ADMINI~1.CLI\locals~1\applic~1" :
  
  3)Recherche Certificats :
  
  Certificat Egroup absent !
  Certificat Electronic-Group absent !
  Certificat OOO-Favorit absent !
  Certificat Sunny-Day-Design-Ltd absent !
  
  4)Recherche fichiers connus :
  
  C:\WINDOWS\system32\JPXHkUvw.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
  
  *** Analyse terminée le 2008-07-18 à 8:35:25,66 ***
  
  merci
  
  0
Réponse 7 / 9
E..T Messages postés 6565 Statut Contributeur 437

Bonsoir,

Peux tu remettre un log hijack.

Merci

@+
0
1. circa901 Messages postés 45 Statut Membre
  
  Bonjour
  
  oui sans probleme le voici
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 11:24:32, on 2008-07-19
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16674)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\S24EvMon.exe
  C:\WINDOWS\system32\acs.exe
  C:\WINDOWS\system32\brsvc01a.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\brss01a.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\WINDOWS\system32\Brmfrmps.exe
  C:\Program Files\Microsoft LifeCam\MSCamS32.exe
  C:\Program Files\Spyware Terminator\sp_rsser.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\1XConfig.exe
  C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Wallpaper\Wallpaper.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Shareaza\Shareaza.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Spyware Terminator\SpywareTerminator.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  O2 - BHO: adzgalore - {8219ae88-e017-49d4-6bfe-4b1b6f6b0baa} - C:\WINDOWS\system32\nsu138.dll
  O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
  O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
  O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
  O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
  O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
  
  0
Réponse 8 / 9
E..T Messages postés 6565 Statut Contributeur 437

Bonsoir,

Télécharge Vundofix.exe (par Atribune) sur ton Bureau.

* Double-clique sur VundoFix.exe afin de le lancer.
* Clique sur le bouton Scan for Vundo.
* Lorsque le scan est complété, clique sur le bouton fix Vundo.
* Une invite de commande demandera si tu souhaites supprimer les fichiers, cliquer sur YES
* Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers.
* Une nouvelle invite de commande annoncera que le PC devrai s'éteindre ("shutdown"). Clique sur OK , puis laisse le redémarrer.
* Le contenu du rapport est situé dans C:\vundofix.txt,

Poste le rapport

@++
0
1. circa901 Messages postés 45 Statut Membre
  
  bonsoir,
  
  j'ai fait le vundofix et il me dit qu'aucun fichier n'est été trouver
  
  merci
  
  0
Réponse 9 / 9
E..T Messages postés 6565 Statut Contributeur 437

Salut,

Tu as toujours ton soucis ?

++
0
1. circa901 Messages postés 45 Statut Membre
  
  non je vien de faire un scan avec mon antispyware et tout est parfait je te remerci
  
  0

Hklm\system\currentcontrolset\services\asc355

9 réponses

Discussions similaires

Newsletters