Virus oneclicksearches

Question

Bonjour,j'ai l'impression de ne pas être tout seul mais c'est moyennement rassurant quand même !Si j'ai compris il faut regarder le hijack log en premier, donc je le poste à la suite ...Sinon pour info j'ai AdAware, SpyBot, Microsoft Antispyware et un Firewall, mai iren n'y fait (Le log donc, et merci bcp de l'aide Logfile of HijackThis v1.99.1Scan saved at 23:49:06, on 22/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Analog Devices\SoundMAX\Smtray.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeC:\Program Files\Network Associates\VirusScan\SHSTAT.EXEC:\Program Files\Network Associates\Common Framework\UpdaterUI.exeC:\WINDOWS\System32\intell32.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Network Associates\Common Framework\FrameworkService.exeC:\Program Files\Network Associates\VirusScan\Mcshield.exec:\progra~1\popfile\popfileib.exeC:\WINDOWS\System32\devldr32.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\Network Associates\VirusScan\VsTskMgr.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.ExeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Outlook Express\msimn.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingF2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exeO1 - Hosts: 127.0.0.0 localhostO1 - Hosts: 127.0.0.2 auditmypc.comO1 - Hosts: 127.0.0.3 boards.cexx.orgO1 - Hosts: 127.0.0.4 bulletproofsoft.netO1 - Hosts: 127.0.0.5 camtech2000.netO1 - Hosts: 127.0.0.6 cexx.orgO1 - Hosts: 127.0.0.7 computercops.usO1 - Hosts: 127.0.0.8 ct7support.comO1 - Hosts: 127.0.0.9 doxdesk.comO1 - Hosts: 127.0.0.20 kellys-korner-xp.comO1 - Hosts: 127.0.0.21 kephyr.comO1 - Hosts: 127.0.0.22 lavasoft.deO1 - Hosts: 127.0.0.23 lavasoftusa.comO1 - Hosts: 127.0.0.24 lurkhere.comO1 - Hosts: 127.0.0.25 majorgeeks.comO1 - Hosts: 127.0.0.26 merijn.orgO1 - Hosts: 127.0.0.27 mjc1.comO1 - Hosts: 127.0.0.28 moosoft.comO1 - Hosts: 127.0.0.29 mvps.orgO1 - Hosts: 127.0.0.30 net-integration.netO1 - Hosts: 127.0.0.31 noadware.netO1 - Hosts: 127.0.0.32 no-spybot.comO1 - Hosts: 127.0.0.33 onlinepcfix.comO1 - Hosts: 127.0.0.34 pchell.comO1 - Hosts: 127.0.0.35 pestpatrol.comO1 - Hosts: 127.0.0.36 safer-networking.orgO1 - Hosts: 127.0.0.37 secure.spykiller.comO1 - Hosts: 127.0.0.38 secureie.comO1 - Hosts: 127.0.0.39 security.kolla.deO1 - Hosts: 127.0.0.40 spybot.infoO1 - Hosts: 127.0.0.41 spychecker.comO1 - Hosts: 127.0.0.42 spychecker.comO1 - Hosts: 127.0.0.43 spycop.comO1 - Hosts: 127.0.0.44 spyguard.comO1 - Hosts: 127.0.0.45 spykiller.comO1 - Hosts: 127.0.0.46 spyware.co.ukO1 - Hosts: 127.0.0.47 spyware-cop.comO1 - Hosts: 127.0.0.48 spywareinfo.comO1 - Hosts: 127.0.0.49 spywarenuker.comO1 - Hosts: 127.0.0.50 spywareremove.comO1 - Hosts: 127.0.0.51 spywareremove.comO1 - Hosts: 127.0.0.52 stopzillapro.comO1 - Hosts: 127.0.0.53 sunbelt-software.comO1 - Hosts: 127.0.0.54 thiefware.comO1 - Hosts: 127.0.0.55 tomcoyote.orgO1 - Hosts: 127.0.0.56 unwantedlinks.comO1 - Hosts: 127.0.0.57 webattack.comO1 - Hosts: 127.0.0.58 wilders.orgO1 - Hosts: 127.0.0.59 www.auditmypc.comO1 - Hosts: 127.0.0.60 www.bulletproofsoft.netO1 - Hosts: 127.0.0.61 www.cexx.orgO1 - Hosts: 127.0.0.62 www.computercops.usO1 - Hosts: 127.0.0.63 www.ct7support.comO1 - Hosts: 127.0.0.64 www.doxdesk.comO1 - Hosts: 127.0.0.65 www.eblocs.comO1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.comO1 - Hosts: 127.0.0.67 www.free-spyware-scan.comO1 - Hosts: 127.0.0.68 www.free-web-browsers.comO1 - Hosts: 127.0.0.69 www.grc.comO1 - Hosts: 127.0.0.70 www.grisoft.comO1 - Hosts: 127.0.0.71 www.hackfaq.orgO1 - Hosts: 127.0.0.72 www.hazeleger.netO1 - Hosts: 127.0.0.73 www.javacoolsoftware.comO1 - Hosts: 127.0.0.74 www.kellys-korner-xp.comO1 - Hosts: 127.0.0.75 www.kephyr.comO1 - Hosts: 127.0.0.76 www.lavasoft.deO1 - Hosts: 127.0.0.77 www.lavasoftusa.comO1 - Hosts: 127.0.0.78 www.lurkhere.comO1 - Hosts: 127.0.0.79 www.majorgeeks.comO1 - Hosts: 127.0.0.80 www.merijn.orgO1 - Hosts: 127.0.0.81 www.mjc1.comO1 - Hosts: 127.0.0.82 www.moosoft.comO1 - Hosts: 127.0.0.83 www.mvps.orgO1 - Hosts: 127.0.0.84 www.net-integration.netO1 - Hosts: 127.0.0.85 www.noadware.netO1 - Hosts: 127.0.0.86 www.no-spybot.comO1 - Hosts: 127.0.0.87 www.onlinepcfix.comO1 - Hosts: 127.0.0.88 www.pchell.comO1 - Hosts: 127.0.0.89 www.pestpatrol.comO1 - Hosts: 127.0.0.94 www.spychecker.comO1 - Hosts: 127.0.0.95 www.spychecker.comO1 - Hosts: 127.0.0.96 www.spycop.comO1 - Hosts: 127.0.0.97 www.spyguard.comO1 - Hosts: 127.0.0.98 www.spykiller.comO1 - Hosts: 127.0.0.99 www.spyware.co.ukO2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hp8DE2.tmpO3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [anvshell] anvshell.exeO4 - HKLM\..\Run: [POINTER] point32.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONEO4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKeyO4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exeO4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Run POPFile.lnk = C:\Program Files\POPFileunpopfile.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://fr.encyclopedia.yahoo.com/rsc/tdserver.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/283ac4bf6971f296ec06/netzip/RdxIE601_fr.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114253419734O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/signup/fr/wowbeta/Si.cabO16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/systemscan/soesysinfo.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cabO16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{53B8C1FB-451E-43FB-95E9-ACBAA5A08992}: NameServer = 80.10.246.1 80.10.246.132O17 - HKLM\System\CCS\Services\Tcpip\..\{BDB65DEB-1C46-44CF-BADC-98A14F788A0C}: NameServer = 193.252.19.3,193.252.19.4O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dllO23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exeO23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exeO23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeO23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe

balltrap34 · Answer

salut commence par ceci
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
tu le decompresse tu double clik dessus et tu choisi l option 1
cela vas generer un rapport donne nous le

redemarre en mode sans echec
en mode sans echec pour cela tu tapote la touche f8
des le debut de l allumage du pc sans t arreter
une fenetre vas souvrir tute deplace avec les fleches du clavier sur demarreren mode sans echec
une fois sur le bureau il ni auras pas toutes les couleurs et autres c est normal.si f8 ne marche pas utilise la touche f5

relance le et choisi cette fois l option 2 et repond oui a tous
redemarre et donne le nouveau rapport

completer a la fin par hijack

Ariman · Answer

D'abord merci cette réponse aussi rapide !Alors mon bureau ne disjoncte plus et j'ai retrouvé les onglets normaux, par contre Microsoft anyispyware pousse quelques cris, j'essaye de bien y répondre mais pas sur ...Mauvais point j'ai toujours le petit ! dans la barre des taches qui me dit gentiment de désinfecter (saloperie ca !)Les logs : 1/ a chaud : -------------------------------------------------------------SmitFraudFix v1.1Rapport fait à  0:15:45.60 le 23/07/2005Executé à partir de C:\Temp\virusOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWSC:\WINDOWS\sites.ini PRESENT !C:\WINDOWS\uninstIU.exe PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32C:\WINDOWS\system32\hhk.dll PRESENT !C:\WINDOWS\system32\hp????.tmp PRESENT !C:\WINDOWS\system32\intell32.exe PRESENT !C:\WINDOWS\system32\intmon.exe PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Zorglub\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program FilesC:\Program Files\PSGuard\ PRESENT!»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport2/ sans échec : --------------------------------------------------------SmitFraudFix v1.1Rapport fait à  0:18:57.42 le 23/07/2005Executé à partir de C:\Temp\virusOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Arret des processusProcessus arreté: AntivirusGold.exeProcessus arreté: bsw.exeProcessus arreté: gunist.exeProcessus arreté: helper.exeProcessus arreté: hookdump.exeProcessus arreté: intel32.exeProcessus arreté: intell32.exeProcessus arreté: intmon.exeProcessus arreté: intmonp.exeProcessus arreté: kernels32.exeProcessus arreté: msmsgs.exeProcessus arreté: msole32.exeProcessus arreté: ole32vbs.exeProcessus arreté: ongi.exeProcessus arreté: popuper.exeProcessus arreté: r.exeProcessus arreté: runsrv32.exeProcessus arreté: shnlog.exeProcessus arreté: svcnt.exeProcessus arreté: spoolsrv32.exeProcessus arreté: uninst.exeProcessus arreté: uninstIU.exeProcessus arreté: w8673492.exeProcessus arreté: winnook.exeProcessus arreté: winstall.exeProcessus arreté: wp.exeProcessus arreté: zloader3.exe»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\WINDOWS\sites.ini suppriméC:\WINDOWS\uninstIU.exe suppriméC:\WINDOWS\system32\hhk.dll suppriméC:\WINDOWS\system32\hp????.tmp suppriméC:\WINDOWS\system32\intell32.exe suppriméC:\WINDOWS\system32\intmon.exe suppriméC:\Program Files\PSGuard\ supprimé »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport3/ le hijack sans échec : -----------------------------------------------Logfile of HijackThis v1.99.1Scan saved at 00:19:46, on 23/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO1 - Hosts: 127.0.0.0 localhostO1 - Hosts: 127.0.0.2 auditmypc.comO1 - Hosts: 127.0.0.3 boards.cexx.orgO1 - Hosts: 127.0.0.4 bulletproofsoft.netO1 - Hosts: 127.0.0.5 camtech2000.netO1 - Hosts: 127.0.0.6 cexx.orgO1 - Hosts: 127.0.0.7 computercops.usO1 - Hosts: 127.0.0.8 ct7support.comO1 - Hosts: 127.0.0.9 doxdesk.comO1 - Hosts: 127.0.0.20 kellys-korner-xp.comO1 - Hosts: 127.0.0.21 kephyr.comO1 - Hosts: 127.0.0.22 lavasoft.deO1 - Hosts: 127.0.0.23 lavasoftusa.comO1 - Hosts: 127.0.0.24 lurkhere.comO1 - Hosts: 127.0.0.25 majorgeeks.comO1 - Hosts: 127.0.0.26 merijn.orgO1 - Hosts: 127.0.0.27 mjc1.comO1 - Hosts: 127.0.0.28 moosoft.comO1 - Hosts: 127.0.0.29 mvps.orgO1 - Hosts: 127.0.0.30 net-integration.netO1 - Hosts: 127.0.0.31 noadware.netO1 - Hosts: 127.0.0.32 no-spybot.comO1 - Hosts: 127.0.0.33 onlinepcfix.comO1 - Hosts: 127.0.0.34 pchell.comO1 - Hosts: 127.0.0.35 pestpatrol.comO1 - Hosts: 127.0.0.36 safer-networking.orgO1 - Hosts: 127.0.0.37 secure.spykiller.comO1 - Hosts: 127.0.0.38 secureie.comO1 - Hosts: 127.0.0.39 security.kolla.deO1 - Hosts: 127.0.0.40 spybot.infoO1 - Hosts: 127.0.0.41 spychecker.comO1 - Hosts: 127.0.0.42 spychecker.comO1 - Hosts: 127.0.0.43 spycop.comO1 - Hosts: 127.0.0.44 spyguard.comO1 - Hosts: 127.0.0.45 spykiller.comO1 - Hosts: 127.0.0.46 spyware.co.ukO1 - Hosts: 127.0.0.47 spyware-cop.comO1 - Hosts: 127.0.0.48 spywareinfo.comO1 - Hosts: 127.0.0.49 spywarenuker.comO1 - Hosts: 127.0.0.50 spywareremove.comO1 - Hosts: 127.0.0.51 spywareremove.comO1 - Hosts: 127.0.0.52 stopzillapro.comO1 - Hosts: 127.0.0.53 sunbelt-software.comO1 - Hosts: 127.0.0.54 thiefware.comO1 - Hosts: 127.0.0.55 tomcoyote.orgO1 - Hosts: 127.0.0.56 unwantedlinks.comO1 - Hosts: 127.0.0.57 webattack.comO1 - Hosts: 127.0.0.58 wilders.orgO1 - Hosts: 127.0.0.59 www.auditmypc.comO1 - Hosts: 127.0.0.60 www.bulletproofsoft.netO1 - Hosts: 127.0.0.61 www.cexx.orgO1 - Hosts: 127.0.0.62 www.computercops.usO1 - Hosts: 127.0.0.63 www.ct7support.comO1 - Hosts: 127.0.0.64 www.doxdesk.comO1 - Hosts: 127.0.0.65 www.eblocs.comO1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.comO1 - Hosts: 127.0.0.67 www.free-spyware-scan.comO1 - Hosts: 127.0.0.68 www.free-web-browsers.comO1 - Hosts: 127.0.0.69 www.grc.comO1 - Hosts: 127.0.0.70 www.grisoft.comO1 - Hosts: 127.0.0.71 www.hackfaq.orgO1 - Hosts: 127.0.0.72 www.hazeleger.netO1 - Hosts: 127.0.0.73 www.javacoolsoftware.comO1 - Hosts: 127.0.0.74 www.kellys-korner-xp.comO1 - Hosts: 127.0.0.75 www.kephyr.comO1 - Hosts: 127.0.0.76 www.lavasoft.deO1 - Hosts: 127.0.0.77 www.lavasoftusa.comO1 - Hosts: 127.0.0.78 www.lurkhere.comO1 - Hosts: 127.0.0.79 www.majorgeeks.comO1 - Hosts: 127.0.0.80 www.merijn.orgO1 - Hosts: 127.0.0.81 www.mjc1.comO1 - Hosts: 127.0.0.82 www.moosoft.comO1 - Hosts: 127.0.0.83 www.mvps.orgO1 - Hosts: 127.0.0.84 www.net-integration.netO1 - Hosts: 127.0.0.85 www.noadware.netO1 - Hosts: 127.0.0.86 www.no-spybot.comO1 - Hosts: 127.0.0.87 www.onlinepcfix.comO1 - Hosts: 127.0.0.88 www.pchell.comO1 - Hosts: 127.0.0.89 www.pestpatrol.comO1 - Hosts: 127.0.0.94 www.spychecker.comO1 - Hosts: 127.0.0.95 www.spychecker.comO1 - Hosts: 127.0.0.96 www.spycop.comO1 - Hosts: 127.0.0.97 www.spyguard.comO1 - Hosts: 127.0.0.98 www.spykiller.comO1 - Hosts: 127.0.0.99 www.spyware.co.ukO3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [anvshell] anvshell.exeO4 - HKLM\..\Run: [POINTER] point32.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONEO4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKeyO4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Run POPFile.lnk = C:\Program Files\POPFileunpopfile.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://fr.encyclopedia.yahoo.com/rsc/tdserver.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/283ac4bf6971f296ec06/netzip/RdxIE601_fr.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114253419734O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/signup/fr/wowbeta/Si.cabO16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/systemscan/soesysinfo.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cabO16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{BDB65DEB-1C46-44CF-BADC-98A14F788A0C}: NameServer = 193.252.19.3,193.252.19.4O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dllO23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exeO23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exeO23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeO23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe4/ bonus , un hijack apres reboot : ------------------------------------Logfile of HijackThis v1.99.1Scan saved at 00:28:55, on 23/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Analog Devices\SoundMAX\Smtray.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeC:\Program Files\Network Associates\VirusScan\SHSTAT.EXEC:\Program Files\Network Associates\Common Framework\UpdaterUI.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Network Associates\Common Framework\FrameworkService.exeC:\Program Files\Network Associates\VirusScan\Mcshield.exeC:\Program Files\Network Associates\VirusScan\VsTskMgr.exec:\progra~1\popfile\popfileib.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.ExeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\System32\intell32.exeC:\WINDOWS\System32\devldr32.exeC:\Program Files\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO1 - Hosts: 127.0.0.0 localhostO1 - Hosts: 127.0.0.2 auditmypc.comO1 - Hosts: 127.0.0.3 boards.cexx.orgO1 - Hosts: 127.0.0.4 bulletproofsoft.netO1 - Hosts: 127.0.0.5 camtech2000.netO1 - Hosts: 127.0.0.6 cexx.orgO1 - Hosts: 127.0.0.7 computercops.usO1 - Hosts: 127.0.0.8 ct7support.comO1 - Hosts: 127.0.0.9 doxdesk.comO1 - Hosts: 127.0.0.20 kellys-korner-xp.comO1 - Hosts: 127.0.0.21 kephyr.comO1 - Hosts: 127.0.0.22 lavasoft.deO1 - Hosts: 127.0.0.23 lavasoftusa.comO1 - Hosts: 127.0.0.24 lurkhere.comO1 - Hosts: 127.0.0.25 majorgeeks.comO1 - Hosts: 127.0.0.26 merijn.orgO1 - Hosts: 127.0.0.27 mjc1.comO1 - Hosts: 127.0.0.28 moosoft.comO1 - Hosts: 127.0.0.29 mvps.orgO1 - Hosts: 127.0.0.30 net-integration.netO1 - Hosts: 127.0.0.31 noadware.netO1 - Hosts: 127.0.0.32 no-spybot.comO1 - Hosts: 127.0.0.33 onlinepcfix.comO1 - Hosts: 127.0.0.34 pchell.comO1 - Hosts: 127.0.0.35 pestpatrol.comO1 - Hosts: 127.0.0.36 safer-networking.orgO1 - Hosts: 127.0.0.37 secure.spykiller.comO1 - Hosts: 127.0.0.38 secureie.comO1 - Hosts: 127.0.0.39 security.kolla.deO1 - Hosts: 127.0.0.40 spybot.infoO1 - Hosts: 127.0.0.41 spychecker.comO1 - Hosts: 127.0.0.42 spychecker.comO1 - Hosts: 127.0.0.43 spycop.comO1 - Hosts: 127.0.0.44 spyguard.comO1 - Hosts: 127.0.0.45 spykiller.comO1 - Hosts: 127.0.0.46 spyware.co.ukO1 - Hosts: 127.0.0.47 spyware-cop.comO1 - Hosts: 127.0.0.48 spywareinfo.comO1 - Hosts: 127.0.0.49 spywarenuker.comO1 - Hosts: 127.0.0.50 spywareremove.comO1 - Hosts: 127.0.0.51 spywareremove.comO1 - Hosts: 127.0.0.52 stopzillapro.comO1 - Hosts: 127.0.0.53 sunbelt-software.comO1 - Hosts: 127.0.0.54 thiefware.comO1 - Hosts: 127.0.0.55 tomcoyote.orgO1 - Hosts: 127.0.0.56 unwantedlinks.comO1 - Hosts: 127.0.0.57 webattack.comO1 - Hosts: 127.0.0.58 wilders.orgO1 - Hosts: 127.0.0.59 www.auditmypc.comO1 - Hosts: 127.0.0.60 www.bulletproofsoft.netO1 - Hosts: 127.0.0.61 www.cexx.orgO1 - Hosts: 127.0.0.62 www.computercops.usO1 - Hosts: 127.0.0.63 www.ct7support.comO1 - Hosts: 127.0.0.64 www.doxdesk.comO1 - Hosts: 127.0.0.65 www.eblocs.comO1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.comO1 - Hosts: 127.0.0.67 www.free-spyware-scan.comO1 - Hosts: 127.0.0.68 www.free-web-browsers.comO1 - Hosts: 127.0.0.69 www.grc.comO1 - Hosts: 127.0.0.70 www.grisoft.comO1 - Hosts: 127.0.0.71 www.hackfaq.orgO1 - Hosts: 127.0.0.72 www.hazeleger.netO1 - Hosts: 127.0.0.73 www.javacoolsoftware.comO1 - Hosts: 127.0.0.74 www.kellys-korner-xp.comO1 - Hosts: 127.0.0.75 www.kephyr.comO1 - Hosts: 127.0.0.76 www.lavasoft.deO1 - Hosts: 127.0.0.77 www.lavasoftusa.comO1 - Hosts: 127.0.0.78 www.lurkhere.comO1 - Hosts: 127.0.0.79 www.majorgeeks.comO1 - Hosts: 127.0.0.80 www.merijn.orgO1 - Hosts: 127.0.0.81 www.mjc1.comO1 - Hosts: 127.0.0.82 www.moosoft.comO1 - Hosts: 127.0.0.83 www.mvps.orgO1 - Hosts: 127.0.0.84 www.net-integration.netO1 - Hosts: 127.0.0.85 www.noadware.netO1 - Hosts: 127.0.0.86 www.no-spybot.comO1 - Hosts: 127.0.0.87 www.onlinepcfix.comO1 - Hosts: 127.0.0.88 www.pchell.comO1 - Hosts: 127.0.0.89 www.pestpatrol.comO1 - Hosts: 127.0.0.94 www.spychecker.comO1 - Hosts: 127.0.0.95 www.spychecker.comO1 - Hosts: 127.0.0.96 www.spycop.comO1 - Hosts: 127.0.0.97 www.spyguard.comO1 - Hosts: 127.0.0.98 www.spykiller.comO1 - Hosts: 127.0.0.99 www.spyware.co.ukO3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [anvshell] anvshell.exeO4 - HKLM\..\Run: [POINTER] point32.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONEO4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKeyO4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Run POPFile.lnk = C:\Program Files\POPFileunpopfile.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://fr.encyclopedia.yahoo.com/rsc/tdserver.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/283ac4bf6971f296ec06/netzip/RdxIE601_fr.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114253419734O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/signup/fr/wowbeta/Si.cabO16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/systemscan/soesysinfo.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cabO16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{53B8C1FB-451E-43FB-95E9-ACBAA5A08992}: NameServer = 80.10.246.1 80.10.246.132O17 - HKLM\System\CCS\Services\Tcpip\..\{BDB65DEB-1C46-44CF-BADC-98A14F788A0C}: NameServer = 193.252.19.3,193.252.19.4O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dllO23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exeO23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exeO23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeO23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeVoila  .... ?

balltrap34 · Answer

ont vas proceder par etaperelance hijack coche et fix toutes les 01refait un hijack

Ariman · Answer

Voila (fait en mode normal, coché les O1, fixed et re scané) :Logfile of HijackThis v1.99.1Scan saved at 00:44:47, on 23/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Analog Devices\SoundMAX\Smtray.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeC:\Program Files\Network Associates\VirusScan\SHSTAT.EXEC:\Program Files\Network Associates\Common Framework\UpdaterUI.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Network Associates\Common Framework\FrameworkService.exeC:\Program Files\Network Associates\VirusScan\Mcshield.exeC:\Program Files\Network Associates\VirusScan\VsTskMgr.exec:\progra~1\popfile\popfileib.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.ExeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\System32\devldr32.exeC:\Program Files\Outlook Express\msimn.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [anvshell] anvshell.exeO4 - HKLM\..\Run: [POINTER] point32.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONEO4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKeyO4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Run POPFile.lnk = C:\Program Files\POPFileunpopfile.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://fr.encyclopedia.yahoo.com/rsc/tdserver.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/283ac4bf6971f296ec06/netzip/RdxIE601_fr.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114253419734O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/signup/fr/wowbeta/Si.cabO16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/systemscan/soesysinfo.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cabO16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{53B8C1FB-451E-43FB-95E9-ACBAA5A08992}: NameServer = 80.10.246.1 80.10.246.132O17 - HKLM\System\CCS\Services\Tcpip\..\{BDB65DEB-1C46-44CF-BADC-98A14F788A0C}: NameServer = 193.252.19.3,193.252.19.4O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dllO23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exeO23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exeO23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeO23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe

balltrap34 · Answer

oki impec
salut

imprime ceci pour ne rien oublier et tous faire
tous faire dans l ordre imperativement
-------------------------
tous da bord telecharge ces programmes si tu ne les a pas et met les a jour mais ne les utilise pas encore et verifie que tu as les bonnes version c est imperatif

ad-aware (1)version 1.06

(ici) http://www.florensac-chasse-trap.com/ section virus
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip

Ariman · Answer

Je fais tout ca, et ca commence déjà à aller bcp mieux :)

balltrap34 · Answer

refait un hijack et quelle soucis il te reste

Virus oneclicksearches

7 réponses

Discussions similaires

Newsletters