a L'aide ! virus win32

Question

Bonjour,
J'ai choppé le fameux virus Win32/adware.virtumonde et win32/PrivacyRemover.m64

je souhaiterais qu'une ame charitable m'aide a m'en debarasser...
De plus, j'ai fais la grosse connerie d'acheter SPYHUNTER ! (peut-on bloquer ou annuler le paiement ?)

Merci de votre precieuse aide....

voici le resultat d'hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17:16, on 15/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Fileshcrw7j0er83hcrw7j0er83.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\IcoSauve.exe
C:\WINDOWS\system32\pphcvw7j0er83.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\TuneUp Utilities 2008\Integrator.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.neuf.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SMrhcrw7j0er83] C:\Program Fileshcrw7j0er83hcrw7j0er83.exe
O4 - HKLM\..\RunOnce: [SpyHunter3 BatchedRemoval] C:\Program Files\Enigma Software Group\SpyHunter\br.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

danny386 · Answer

Télécharger sur le bureau malwarebytes à cette adresse : 

https://www.androidworld.fr/ 

Voici un tuto pour bien l installer et bien l utiliser : 

https://www.androidworld.fr/­ml 


Après l analyse, redémarrer le pc et poste le rapport !!

boootzilla · Answer

Merci dany

Ca Scanne et je poste le resultat ;)

Pour le paiement de spyhunter, tu sais s'il y a un recours ? si on peut annuler le paiement ou le bloquer a la banque ?

eScan · Answer

Salut boootzilla,

Si jamais ça ne marche pas, tu peux essayer avec eScan :

1) Télécharge eScan Virus cleaner depuis ce lien : 
http://www.escan-ch.com/downloads/escan_virus_cleaner.exe

2) Il n'y a rien a installer ... il faut juste l'exécuter au point 4

3) Redémarre en mode sans échec

4) Fais un scan complet avec eScan Virus cleaner (il suffit de lancer l'exe et de choisir toutes les options)

5) Laisse le scanner tout ton PC

6) Regarde ce qu'il a trouvé et supprimé

7) Redémarre en mode normal et normalement c'est tout bon (sinon tu peux recommencer au point 3)

boootzilla · Answer

voila le rapport:

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1155
Windows 5.1.2600 Service Pack 2

15/09/2008 15:46:37
mbam-log-2008-09-15 (15-46-37).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 67329
Temps écoulé: 9 minute(s), 48 second(s)

Processus mémoire infecté(s): 3
Module(s) mémoire infecté(s): 5
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 12
Fichier(s) infecté(s): 31

Processus mémoire infecté(s):
C:\Program Fileshcrw7j0er83hcrw7j0er83.exe (Rogue.Multiple) -> Unloaded process successfully.
C:\WINDOWS\system32\pphcvw7j0er83.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\WINDOWS\system32\drivers\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Program Fileshcrw7j0er83\MFC71.dll (Rogue.Multiple) -> Delete on reboot.
C:\Program Fileshcrw7j0er83\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.
C:\Program Fileshcrw7j0er83\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.
C:\WINDOWS\system32	dssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSl.dll (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallhcrw7j0er83 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWAREhcrw7j0er83 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	dssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE	dss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhcrw7j0er83 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Fileshcrw7j0er83 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Application Datahcrw7j0er83\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Fileshcrw7j0er83\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83hcrw7j0er83.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83hcrw7j0er83.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshcrw7j0er83\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	dssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers	dssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\blphcvw7j0er83.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcvw7j0er83.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pphcvw7j0er83.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\poloo\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

boootzilla · Answer

Je n'ai plus que le fond d'ecran bleu...
les virus sont supprimés ?

eScan · Answer

Est-ce que tu as essayé avec eScan ?

boootzilla · Answer

ben non, j'vaais commencé avec malware...
je voulais pas essayer 2 trucs en même temps...

la methode de dany n'est pas efficace ?

eScan · Answer

J'ai été convaincu avec eScan, il repère un grand nombre de virus.

Quand tu essayeras ,et si par la suite tu veux une recherche plus avancée,
coche la case examiner et la rechercher se divisera en deux : une partie qui scanne et un autre qui recherche où il y aurait la probabilité d'être infecter par un virus.

boootzilla · Answer

merci escan

ben je veux bien le tester mais j'aimerais savoir si la methode malware de dany a tout supprimer ou pas.
si c'est le cas, je sais pas si c'est utile d'essayer escan ?

eScan · Answer

C'est toi qui vois. Mais si tu n'es pas convaincu ou que tu as des doutes sur tes actions précédentes, n'hésite pas à utiliser eScan.

Tu as un outil de plus dans ta poche ;) !

danny386 · Answer

J'essayerai quand même eScan pour être sur. (Désolé pour l'absence) Et c'est Danny pas Dany.

boootzilla · Answer

Ok je vais quand même essayer escan.
Merci 1000 fois a tous les 2 en tous cas et desolé d'avoir écorché ton nom Danny ;)

danny386 · Answer

Pas grave lol (enfin si c'est grave ... Ggggrrrrr) lol. Dis nous quoi après.

A L'aide ! virus win32

13 réponses

Votre réponse

Discussions similaires

Newsletters