Virus c\bat

symaja2 -  
bonjour, j'ai encore quelques virus dont je n'arrive pas à me défaire, qui aurait le temps de m'aider ?

j'attends vos instructions !

a tout de suite !

17 réponses

  2. symaja2 Auteur
    Peux-tu m'éclairer qu'est-ce que le SP1 et le SP 2 ?
    et le pack 2 ? j'avoue que là je ne sais pas !

    Lol!

    A +
    1. Utilisateur anonyme
      salut
      tu as fais tes mises a jour mais tu n es pas passer ni au sp1 ni au sp2
      ce serait bien de mettre le service pack 2

      a+
      1. symaja2 Auteur
        Salut, j'ai ft mes mise à jours hier avec le lien que tu m'avais donné et voici le scan en ligne

        A +

        Merci

        BitDefender Online Scanner

        Scan report generated at: Mon, Oct 31, 2005 - 12:25:16

        Scan path: A:\;C:\;D:\;E:\;

        Statistics

        Time
        00:28:56

        Files
        60801

        Folders
        3326

        Boot Sectors
        2

        Archives
        596

        Packed Files
        5916

        Results

        Identified Viruses
        3

        Infected Files
        6

        Suspect Files
        0

        Warnings
        0

        Disinfected
        0

        Deleted Files
        5

        Engines Info

        Virus Definitions
        231869

        Engine build
        AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

        Scan plugins
        13

        Archive plugins
        39

        Unpack plugins
        4

        E-mail plugins
        6

        System plugins
        1

        Scan Settings

        First Action
        Disinfect

        Second Action
        Delete

        Heuristics
        Yes

        Enable Warnings
        Yes

        Scanned Extensions
        exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

        Exclude Extensions

        Scan Emails
        Yes

        Scan Archives
        Yes

        Scan Packed
        Yes

        Scan Files
        Yes

        Scan Boot
        Yes

        Scanned File
        Status

        C:\WINDOWS\system32\svgshosts.exe
        Infected with: Backdoor.SDBot.EEBF6DD4

        C:\WINDOWS\system32\svgshosts.exe
        Deleted

        C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
        Infected with: Win32.IRC.Kelebek

        C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
        Disinfection failed

        C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
        Delete failed

        C:\Program Files\Adobe\Acrobat 7.0\Help\island.exe
        Infected with: Trojan.Flood.22016

        C:\Program Files\Adobe\Acrobat 7.0\Help\island.exe
        Disinfection failed

        C:\Program Files\Adobe\Acrobat 7.0\Help\island.exe
        Deleted

        C:\Recycled\Dc76.exe
        Infected with: Backdoor.SDBot.EEBF6DD4

        C:\Recycled\Dc76.exe
        Deleted

        C:\zf.exe=>(RAR Sfx o)=>drwo.exe
        Infected with: Win32.IRC.Kelebek

        C:\zf.exe=>(RAR Sfx o)=>drwo.exe
        Disinfection failed

        C:\zf.exe=>(RAR Sfx o)=>drwo.exe
        Deleted

        C:\zf.exe=>(RAR Sfx o)
        Update failed

        C:\zf.exe=>(RAR Sfx o)=>island.exe
        Infected with: Trojan.Flood.22016

        C:\zf.exe=>(RAR Sfx o)=>island.exe
        Disinfection failed

        C:\zf.exe=>(RAR Sfx o)=>island.exe
        Deleted

        C:\zf.exe=>(RAR Sfx o)
        Update failed
        3. symaja2 Auteur
          decidement tu vois tout, non j'avais pas fait les mises à jour j'y ai pensé qu'aprés, du coup , j'ai refait un scan hiojackthis que voici

          Ps Avg détecte toujours un virus du type : IRC\BackDooor.Flood

          A +

          Merci

          Logfile of HijackThis v1.99.1
          Scan saved at 09:04:45, on 31/10/2005
          Platform: Windows XP (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
          C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
          C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\WINDOWS\System32\ctfmon.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
          C:\Program Files\ewido\security suite\ewidoctrl.exe
          C:\Program Files\ewido\security suite\ewidoguard.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\WINDOWS\System32\wuauclt.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\PROGRA~1\Grisoft\AVG7\avgw.exe
          C:\Documents and Settings\n\Bureau\HijackThis.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*http://fr.yahoo.com
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.fr/
          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
          O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
          O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe --background
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [Microsoft Security Panagers] uyzdkfvkf.exe
          O4 - HKLM\..\Run: [SECRETSERVICE] C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
          O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
          O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
          O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
          O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129751595348
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
          O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://webalbum.foto.com/activeX/newUploadFotoCom.CAB
          O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
          O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
          O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
          2. symaja2 Auteur
            Voici le dernier log ! j'expère qu'on tient le bon bout lol !
            A +
            Syl

            Logfile of HijackThis v1.99.1
            Scan saved at 18:41:02, on 30/10/2005
            Platform: Windows XP (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
            C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
            C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
            C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
            C:\Program Files\QuickTime\qttask.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
            C:\WINDOWS\System32\ctfmon.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
            C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
            C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
            C:\Program Files\ewido\security suite\ewidoctrl.exe
            C:\Program Files\ewido\security suite\ewidoguard.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Documents and Settings\n\Bureau\HijackThis.exe

            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*http://fr.yahoo.com
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.fr/
            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
            O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
            O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
            O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
            O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe --background
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [Microsoft Security Panagers] uyzdkfvkf.exe
            O4 - HKLM\..\Run: [SECRETSERVICE] C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
            O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
            O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
            O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
            O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
            O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
            O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
            O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
            O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
            O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
            O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
            O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
            O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129751595348
            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
            O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://webalbum.foto.com/activeX/newUploadFotoCom.CAB
            O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
            O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
            O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
            O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
            O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
            O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
            1. Utilisateur anonyme
              salut
              ca c est tout a la fin...ok
              redemarre manuellement ton pc et remet un log

              a+
              1. symaja2 Auteur
                Euh coucou régis petit pbl, voilà le message d'ereur qd je veux éliminer le fichier:Pending filr rename Operations registry data has been removed by external process ! dsl mais je speek beaucoup mieux espagnol qu'anglais ! a priori le log ne peut pas supprimer le fichier isn't it ?

                a+

                Merci
                1. Utilisateur anonyme
                  re,

                  Télécharge: Pocket Killbox ici
                  http://www.downloads.subratam.org/KillBox.exe

                  :: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::
                  http://pageperso.aol.fr/balltrap34/killbox.htm
                  ***
                  fixe le
                  O4 - HKLM\..\Run: [Microsoft Security Panagers] uyzdkfvkf.exe

                  Double clic sur killbox.exe (Pocket Killbox)

                  - coche: delete on reboot
                  - Dans "Full Path of File to Delete"
                  copie et colle:

                  C:\WINDOWS\System32\uyzdkfvkf.exe

                  - clique sur la croix rouge
                  - une fenêtre va apparaître pour confirmation clique sur YES
                  - une seconde fenêtre te demande si tu veux redémarrer clique sur YES

                  Laisse le pc redémarrer.
                  Fais tes mises a jour, met le sp2
                  http://update.microsoft.com/windowsupdate/v6/default.aspx?ln=fr
                  Et après reposte un log HijackThis.

                  A+
                  1. symaja2 Auteur
                    Bonjour

                    Me revoilà, aujourd'hui j'ai un peu de temps pour m'occuper de cette éradication ... voici le noueau hijackthis aprés suppression du fameux fichier

                    A +

                    Logfile of HijackThis v1.99.1
                    Scan saved at 13:24:45, on 30/10/2005
                    Platform: Windows XP (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                    C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
                    C:\Program Files\QuickTime\qttask.exe
                    C:\Program Files\iTunes\iTunesHelper.exe
                    C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                    C:\WINDOWS\System32\ctfmon.exe
                    C:\Program Files\Messenger\msmsgs.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
                    C:\Program Files\ewido\security suite\ewidoctrl.exe
                    C:\Program Files\ewido\security suite\ewidoguard.exe
                    C:\Program Files\iPod\bin\iPodService.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgwb.dat
                    C:\PROGRA~1\Grisoft\AVG7\avgw.exe
                    C:\Documents and Settings\n\Bureau\HijackThis.exe

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*http://fr.yahoo.com
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.fr/
                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
                    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
                    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                    O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe --background
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                    O4 - HKLM\..\Run: [Microsoft Security Panagers] uyzdkfvkf.exe
                    O4 - HKLM\..\Run: [SECRETSERVICE] C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                    O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                    O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
                    O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
                    O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
                    O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
                    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129751595348
                    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
                    O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://webalbum.foto.com/activeX/newUploadFotoCom.CAB
                    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                    O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
                    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
                    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    1. Utilisateur anonyme
                      re
                      ¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

                      O4 - HKLM\..\RunServices: [Microsoft Security Panagers] uyzdkfvkf.exe

                      ----------------------------------------------------------------------------
                      ¤Recherche et supprime ceci:
                      attention seulement les fichiers (si présents).

                      C:\WINDOWS\System32\uyzdkfvkf.exe

                      redemarre et remet un rapport

                      a+
                      1. symaja2 Auteur
                        This is a report processed by VirusTotal on 10/28/2005 at 20:39:11 (CET) after scanning the file "uyzdkfvkf.exe" file.
                        Antivirus Version Update Result
                        AntiVir 6.32.0.6 10.28.2005 Worm/RBot.133842
                        Avast 4.6.695.0 10.27.2005 Win32:SdBot-gen
                        AVG 718 10.24.2005 no virus found
                        Avira 6.32.0.6 10.28.2005 Worm/RBot.133842
                        BitDefender 7.2 10.28.2005 Backdoor.SDBot.EEBF6DD4
                        CAT-QuickHeal 8.00 10.26.2005 (Suspicious) - DNAScan
                        ClamAV devel-20050917 10.27.2005 Worm.Mytob.GH
                        DrWeb 4.32b 10.23.2005 Win32.HLLW.MyBot
                        eTrust-Iris 7.1.194.0 10.27.2005 MS03-026_Exploit!Trojan
                        eTrust-Vet 11.9.1.0 10.28.2005 no virus found
                        Fortinet 2.48.0.0 10.27.2005 no virus found
                        F-Prot 3.16c 10.26.2005 no virus found
                        Ikarus 0.2.59.0 10.28.2005 Backdoor.Win32.Rbot.Gen
                        Kaspersky 4.0.2.24 10.28.2005 Backdoor.Win32.Rbot.gen
                        McAfee 4615 10.28.2005 W32/Sdbot.worm.gen.by
                        NOD32v2 1.1266 10.26.2005 a variant of Win32/Rbot
                        Norman 5.70.10 10.28.2005 W32/Spybot.XAQ
                        Panda 8.02.00 10.28.2005 W32/Gaobot.KEV.worm
                        Sophos 3.99.0 10.28.2005 W32/Rbot-Fam
                        Symantec 8.0 10.27.2005 no virus found
                        TheHacker 5.8.4.128 10.26.2005 no virus found
                        VBA32 3.10.4 10.28.2005 no virus found

                        VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.> Go to: Home Contact En español
                        --------------------------------------------------------------------------------
                        www.virustotal.com :: @ Hispasec Sistemas 2004 :: e-mail info@virustotal.com

                        merci pour ton aide

                        et à tout de suite!

                        Syl
                        2. symaja2 Auteur
                          ogfile of HijackThis v1.99.1
                          Scan saved at 20:14:05, on 28/10/2005
                          Platform: Windows XP (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
                          C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
                          C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
                          C:\Program Files\QuickTime\qttask.exe
                          C:\Program Files\iTunes\iTunesHelper.exe
                          C:\WINDOWS\System32\uyzdkfvkf.exe
                          C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
                          C:\WINDOWS\System32\ctfmon.exe
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                          C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                          C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
                          C:\Program Files\ewido\security suite\ewidoctrl.exe
                          C:\Program Files\ewido\security suite\ewidoguard.exe
                          C:\Program Files\iPod\bin\iPodService.exe
                          C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                          C:\Program Files\Windows Media Player\wmplayer.exe
                          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          C:\Program Files\Real\RealPlayer\RealPlay.exe
                          C:\Documents and Settings\n\Local Settings\Temp\Répertoire temporaire 4 pour hijackthis_199.zip\HijackThis.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*http://fr.yahoo.com
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.fr/
                          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
                          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
                          O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
                          O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                          O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe --background
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                          O4 - HKLM\..\Run: [Microsoft Security Panagers] uyzdkfvkf.exe
                          O4 - HKLM\..\Run: [SECRETSERVICE] C:\Program Files\Adobe\Acrobat 7.0\Help\drwo.exe
                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                          O4 - HKLM\..\RunServices: [Microsoft Security Panagers] uyzdkfvkf.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                          O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
                          O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
                          O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                          O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
                          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
                          O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
                          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
                          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129751595348
                          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
                          O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://webalbum.foto.com/activeX/newUploadFotoCom.CAB
                          O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                          O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                          O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
                          O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
                          O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                          O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

                          voilà le scan

                          j'attends de tes nouvelles

                          merci !
                          1. Utilisateur anonyme
                            salut
                            , télécharge HijackThis ici:
                            http://www.hijackthis.de/downloads/hijackthis_199.zip

                            Dézippe le dans un dossier prévu à cet effet.
                            Par exemple C:\hijackthis < Enregistre le bien dans c : !
                            Lance le puis:
                            clique sur "do a system scan and save logfile" (cf démo)
                            faire un copier coller du log entier sur le forum

                            Démo : (merci à balltrap34 pour cette réalisation)
                            http://pageperso.aol.fr/balltrap34/demohijack.htm

                            Bon courage

                            A+

                            Discussions similaires

                            Softonic,est-ce un virus ?
                            techmel1

                            6 réponses
                            Chrome://newtab
                            Nova

                            14 réponses
                            Désinstaller Softonic
                            Diguimette

                            5 réponses
                            pasage de txt a bat
                            mat5000

                            8 réponses
                            @ECHO OFF
                            choco90

                            3 réponses