Win59.tmp.exe?

victorbravo -

salut a tous
je pense avoir chopé une cochonnerie.je vous passe mon hijack et dites moi ce qu'il en est .
d'avance merci.
Logfile of HijackThis v1.99.1
Scan saved at 18:24:36, on 25/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: LightFrame3IECOM - {43D29D14-460E-4F3A-9037-E60F11EF12F0} - C:\WINDOWS\system32\LightFrame3IECOM.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF057D2B-77A0-4D09-B22B-7D4AD305AD21}: NameServer = 80.10.246.1 80.10.246.132
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: qomkkii - C:\WINDOWS\SYSTEM32\qomkkii.dll
--
sérénité,efficacité

Afficher la suite

16 réponses

Résumé de la discussion

Une suspicion d'infection malware est évoquée après un rapport HijackThis et des éléments suspects dans les processus et les démarrages sous Windows XP. Plusieurs conseils s'appuient sur des outils d'analyse et de nettoyage, notamment VirusTotal pour un fichier DLL suspect, AVG Anti-Spyware et SmitFraudFix. Les rapports évoquent des éléments potentiellement indésirables comme des BHO, des entrées Start Page modifiées et des services liés à Vundo, avec des résultats variables selon les moteurs. En pratique, l'approche combine dépistage manuel et outils dédiés, et souligne que les détections peuvent varier; il faut compiler les rapports pour analyses complémentaires.

Réponse 1 / 16
Regis59 Contributeur sécurité
Salut

Oui attention aux telechargements.

Bon courage et soit prudent.

A+

0

Réagir
Réponse 2 / 16
Regis59 Contributeur sécurité
Salut,

C'est ok !

On peut conclure? Des questions?

a+

0

Réagir
1. victorbravo Auteur
  
  Re,
  pb résolu.merci
  faut que je fasse gaffe a ce que je telecharge ( pourtant rien d'illegal ).
  les derniers scan ne montrent rien de particulier.
  pas de questions pour l'instant .
  merci Regis59
  
  0
  
  Réagir
Réponse 3 / 16
Regis59 Contributeur sécurité
Salut,

Ou en sont tes soucis?

a+

0

Réagir
1. victorbravo Auteur
  
  salut Regis59,
  apres un scan a2 , nod 32 et avg antispyware,rien a déclarer.
  mon log hijack ne montre rien de suspect, enfin je crois .
  je te remercie encore pour ton aide précieuse.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 10:13:31, on 27/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5730.0011)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\Program Files\Eset\nod32krn.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
  C:\Program Files\Eset\nod32kui.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: LightFrame3IECOM - {43D29D14-460E-4F3A-9037-E60F11EF12F0} - C:\WINDOWS\system32\LightFrame3IECOM.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
  O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  
  0
  
  Réagir
Réponse 4 / 16
victorbravo Auteur
Re,
j'ai fixé les lignes .
pour l'instant, a2 n'a rien trouvé de meme que avg antispyware.
j'espere que tout ce qu'on a fait a eradiqué le pb.

Logfile of HijackThis v1.99.1
Scan saved at 20:28:32, on 26/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: LightFrame3IECOM - {43D29D14-460E-4F3A-9037-E60F11EF12F0} - C:\WINDOWS\system32\LightFrame3IECOM.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF057D2B-77A0-4D09-B22B-7D4AD305AD21}: NameServer = 80.10.246.130 80.10.246.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

et je te remercie pour toute l' aide que tu m'auras apporté.

0

Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 16
Regis59 Contributeur sécurité
Salut,

¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

O2 - BHO: (no name) - {D0A7DFA0-BB45-4B3A-97BA-419C7DE4A303} - (no file)

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled

O20 - Winlogon Notify: winemx32 - winemx32.dll (file missing)

Ferme HijackThis.

Dis moi ensuite quels soucis te restent ils?

A+

0

Réagir
Réponse 6 / 16
Regis59 Contributeur sécurité
Re,

Oui une.

1/

Télécharge: Pocket Killbox ici
http://www.downloads.subratam.org/KillBox.exe

:: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::
http://pageperso.aol.fr/balltrap34/killbox.htm

2/

puis lancer HijackThis:

clique sur "do a system scan only"

* Cocher la case au début de ces lignes:

O2 - BHO: (no name) - {1888045F-2D95-4363-8F52-35D1CBF23BF7} - (no file)

O2 - BHO: (no name) - {371F1C6F-38FF-4AE4-8DF9-5ED9A089A505} - (no file)

O2 - BHO: (no name) - {D0A7DFA0-BB45-4B3A-97BA-419C7DE4A303} - (no file

O11 - Options group: [INTERNATIONAL] International*

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61}
(HouseCall Control) - http://a840.g.akamai.net/

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O20 - Winlogon Notify: winemx32 - C:\WINDOWS\SYSTEM32\winemx32.dll

* Valider avec fix checked

5/

Double clic sur killbox.exe (Pocket Killbox)

- coche: delete on reboot
- Dans "Full Path of File to Delete"
- Sélectionne "single File"
-copie et colle:

C:\WINDOWS\SYSTEM32\winemx32.dll

- clique sur la croix rouge
- une fenêtre va apparaître pour confirmation clique sur YES
- une seconde fenêtre te demande si tu veux redémarrer clique sur YES

Si ce message s’affiche ignore le :
http://tinypic.com/images/goodbye.jpg
Laisse le pc redémarrer.

Et après reposte un log HijackThis.

A+

0

Réagir
1. victorbravo Auteur
  
  Re,
  voila mon hijack apres les manips
  Logfile of HijackThis v1.99.1
  Scan saved at 17:47:24, on 26/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5730.0011)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\Program Files\Eset\nod32krn.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
  C:\Program Files\Eset\nod32kui.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: LightFrame3IECOM - {43D29D14-460E-4F3A-9037-E60F11EF12F0} - C:\WINDOWS\system32\LightFrame3IECOM.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {D0A7DFA0-BB45-4B3A-97BA-419C7DE4A303} - (no file)
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{BF057D2B-77A0-4D09-B22B-7D4AD305AD21}: NameServer = 80.10.246.1 80.10.246.132
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: winemx32 - winemx32.dll (file missing)
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
  
  merci pour ta reponse
  
  0
  
  Réagir
Réponse 7 / 16
Regis59 Contributeur sécurité
Re,

Scan ton pc avec ceci:
AVG Anti-Spyware :
https://www.malekal.com/avg-antivirus-free-antivirus-gratuit-pour-proteger-son-pc-des-virus/

Supprime tout ce qu il trouvera

Copie colle le rapport

a+

0

Réagir
1. victorbravo Auteur
  
  Re,
  R A S au scan d ' AVG antispyware.voici mon hijack this.
  les lignes 020 sont elles nocives?
  encore merci pour ton aide Regis59.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 17:07:23, on 26/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5730.0011)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\Program Files\Eset\nod32krn.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
  C:\Program Files\Eset\nod32kui.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {1888045F-2D95-4363-8F52-35D1CBF23BF7} - (no file)
  O2 - BHO: (no name) - {371F1C6F-38FF-4AE4-8DF9-5ED9A089A505} - (no file)
  O2 - BHO: LightFrame3IECOM - {43D29D14-460E-4F3A-9037-E60F11EF12F0} - C:\WINDOWS\system32\LightFrame3IECOM.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {D0A7DFA0-BB45-4B3A-97BA-419C7DE4A303} - (no file)
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{BF057D2B-77A0-4D09-B22B-7D4AD305AD21}: NameServer = 80.10.246.130 80.10.246.3
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
  O20 - Winlogon Notify: winemx32 - C:\WINDOWS\SYSTEM32\winemx32.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  
  0
  
  Réagir
Réponse 8 / 16
Regis59 Contributeur sécurité
ok,

tiens moi au courant

a+

0

Réagir
1. victorbravo Auteur
  
  Re
  voici mon hijack apres avoir passe a2 et ccleaner
  Logfile of HijackThis v1.99.1
  Scan saved at 16:08:26, on 26/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5730.0011)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Eset\nod32krn.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
  C:\Program Files\Eset\nod32kui.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {1888045F-2D95-4363-8F52-35D1CBF23BF7} - (no file)
  O2 - BHO: (no name) - {371F1C6F-38FF-4AE4-8DF9-5ED9A089A505} - (no file)
  O2 - BHO: LightFrame3IECOM - {43D29D14-460E-4F3A-9037-E60F11EF12F0} - C:\WINDOWS\system32\LightFrame3IECOM.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {D0A7DFA0-BB45-4B3A-97BA-419C7DE4A303} - (no file)
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{BF057D2B-77A0-4D09-B22B-7D4AD305AD21}: NameServer = 80.10.246.1 80.10.246.132
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
  O20 - Winlogon Notify: winemx32 - C:\WINDOWS\SYSTEM32\winemx32.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  merci
  
  0
  
  Réagir
Réponse 9 / 16
Regis59 Contributeur sécurité
Salut

Rien de grave.

Utilise ceci:
Ccleaner :

https://www.malekal.com/tutoriel-ccleaner/

Relance ensuite a².
Enfin remet un hijack this

a+

0

Réagir
1. victorbravo Auteur
  
  ok merci pour ton aide.
  je relance tout
  
  0
  
  Réagir
Réponse 10 / 16
Regis59 Contributeur sécurité
Re,

Tu es l administrateur du pc?
il y des restriction, est ce normal?

A+

0

Réagir
1. victorbravo Auteur
  
  Re,
  oui je suis l'administrateur du pc et non ce n'est pas normal qu'il y ait des restrictions.
  ça vient d'ou ces restictions?
  
  0
  
  Réagir
2. victorbravo Auteur
  
  je viens de faire un scan avec a2 et j'ai encore des cochonneries.j'ai l'impression que le trojan se regenere tout le temps.
  Version - a-squared Free 2.1
  
  Réglages Scan:
  
  Objets: Mémoire, Traces, Cookies, C:\, D:\, E:\
  Scan archives: Marche
  Heuristiques: Marche
  Scan ADS: Marche
  
  Début du scan: 26/11/2006 14:35:46
  
  C:\Documents and Settings\fab\Bureau\SmitfraudFix\SmitfraudFix\Reboot.exe Détecter: Riskware.RiskTool.Win32.Reboot.f
  C:\Documents and Settings\fab\Bureau\SmitfraudFix.zip/Reboot.exe Détecter: Riskware.RiskTool.Win32.Reboot.f
  C:\Documents and Settings\fab\Local Settings\Temporary Internet Files\Content.IE5\633JE2QT\srvzst[1].exe Détecter: Heuristic.Dialer
  C:\Documents and Settings\fab\Local Settings\Temporary Internet Files\Content.IE5\L0JKD1SC\srvbjs[1].exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\idd136.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\idd17A.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\idd2B5.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\idd2E0.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddCC.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\win134.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\win178.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\winCA.tmp.exe Détecter: Heuristic.Dialer
  
  Scanné
  
  Fichiers: 127920
  Traces: 84481
  Cookies: 3
  Processus: 26
  
  Trouver
  
  Fichiers: 12
  Traces: 0
  Cookies: 0
  Processus: 0
  Clés de Registre: 0
  
  Fin du Scan: 26/11/2006 15:03:49
  Temps du Scan: 00:28:03
  
  0
  
  Réagir
Réponse 11 / 16
Regis59 Contributeur sécurité
Ok, remet un hijack this stp

a+

0

Réagir
1. victorbravo Auteur
  
  Re,
  voila mon hijack
  Logfile of HijackThis v1.99.1
  Scan saved at 14:22:07, on 26/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5730.0011)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Comodo\Firewall\cmdagent.exe
  C:\Program Files\Eset\nod32krn.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
  C:\Program Files\Eset\nod32kui.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Comodo\Firewall\CPF.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\TEMP\winCA.tmp.exe
  C:\WINDOWS\TEMP\iddCC.tmp.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
  O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{BF057D2B-77A0-4D09-B22B-7D4AD305AD21}: NameServer = 80.10.246.1 80.10.246.132
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
  
  0
  
  Réagir
Réponse 12 / 16
Regis59 Contributeur sécurité
Salut Afideg,

Merci.....
Je m'attardais d abord sur Vundo...

a+

0

Réagir
1. victorbravo Auteur
  
  salut Regis59,
  voici tous les rapports de vundo fix que j'ai fait.
  il me semble que la bete est encore la et le fix de symantec ne la detecte pas .
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 20:35:14 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  Beginning removal...
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 20:51:57 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 21:04:56 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 22:10:20 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 22:11:23 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 22:16:04 25/11/2006
  
  Listing files found while scanning....
  
  C:\WINDOWS\system32\ijkmp.ini
  C:\WINDOWS\system32\ijkmp.bak1
  
  Beginning removal...
  
  Attempting to delete C:\WINDOWS\system32\pmkji.dll
  C:\WINDOWS\system32\pmkji.dll Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\ijkmp.ini
  C:\WINDOWS\system32\ijkmp.ini Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\ijkmp.bak1
  C:\WINDOWS\system32\ijkmp.bak1 Has been deleted!
  
  Performing Repairs to the registry.
  Done!
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 22:18:41 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 22:22:05 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 22:59:07 25/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 23:55:18 25/11/2006
  
  Listing files found while scanning....
  
  C:\WINDOWS\system32\knnmp.ini
  C:\WINDOWS\system32\knnmp.bak1
  
  Beginning removal...
  
  Attempting to delete C:\WINDOWS\system32\pmnnk.dll
  C:\WINDOWS\system32\pmnnk.dll Could not be deleted.
  
  Attempting to delete C:\WINDOWS\system32\knnmp.ini
  C:\WINDOWS\system32\knnmp.ini Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\knnmp.bak1
  C:\WINDOWS\system32\knnmp.bak1 Has been deleted!
  
  Performing Repairs to the registry.
  Done!
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 01:02:08 26/11/2006
  
  Listing files found while scanning....
  
  C:\WINDOWS\system32\knnmp.ini
  
  Beginning removal...
  
  Attempting to delete C:\WINDOWS\system32\pmnnk.dll
  C:\WINDOWS\system32\pmnnk.dll Could not be deleted.
  
  Attempting to delete C:\WINDOWS\system32\knnmp.ini
  C:\WINDOWS\system32\knnmp.ini Has been deleted!
  
  Performing Repairs to the registry.
  Done!
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 01:14:36 26/11/2006
  
  Listing files found while scanning....
  
  C:\WINDOWS\system32\knnmp.ini
  
  Beginning removal...
  
  Attempting to delete C:\WINDOWS\system32\pmnnk.dll
  C:\WINDOWS\system32\pmnnk.dll Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\knnmp.ini
  C:\WINDOWS\system32\knnmp.ini Has been deleted!
  
  Performing Repairs to the registry.
  Done!
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 01:18:04 26/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 01:18:12 26/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 01:19:38 26/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 01:24:31 26/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 01:48:33 26/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 13:50:54 26/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  VundoFix V6.2.11
  
  Checking Java version...
  
  Java version is 1.5.0.5
  
  Java version is 1.5.0.9
  
  Scan started at 13:51:21 26/11/2006
  
  Listing files found while scanning....
  
  No infected files were found.
  
  0
  
  Réagir
Réponse 13 / 16
afideg Contributeur sécurité
Bonjour vous deux,

Pour Régis59:

Notre amigo boule me renseignait ainsi il y a peu sur ligne 06:

« - Définition : O6 = Accès aux options IE restreints par l'Administrateur
- Donc, si ce n'est pas la personne qui à touché aux options, il a de forte chance que ce soit une bestiole .

- Ce à quoi çà ressemble :
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present .

- Que faire :

1- Sauf si vous avez activé l'option "Lock homepage from changes" (= verrouiller le changement de page de démarrage) dans Spybot S&D,
ou si votre administrateur système l'a mise en place,
faites réparer par HijackThis ( = fixer les lignes ).

2- Comme indiqué ci-dessus, Spybot peut faire apparaître cette ligne, suite à un 'blocage" de la page de démarrage .
Dans ce cas là tout est normal, mais rares sont les utilisateurs aptes à utiliser Spybot pour ce genre d'options.

Al.

0

Réagir
Réponse 14 / 16
Regis59 Contributeur sécurité
Re,

ok.
Dans ce cas, choisis scan for vundo et ensuite remove vundo.
N'oublie pas de me fournir le rapport stp

A+

0

Réagir
Réponse 15 / 16
Regis59 Contributeur sécurité
Re,

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4

Double-clique VundoFix.exe afin de le lancer.
Coche Run VundoFix as a task.
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok
Clique sur le bouton Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
Démarre ton PC à nouveau.
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

0

Réagir
1. victorbravo Auteur
  
  Re,
  le probleme quand je telecharge Vundofix, je nne peux pas cocher run as a task parce que ça n'apparait pas .tout de suite j'ai une fenetre qui me dit scan for vundo et remove vundo.
  je te laisse mon hijack.
  merci.
  Logfile of HijackThis v1.99.1
  Scan saved at 22:19:28, on 25/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5730.0011)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Comodo\Firewall\cmdagent.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Eset\nod32krn.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
  C:\Program Files\Eset\nod32kui.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Comodo\Firewall\CPF.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\System32\wbem\wmiprvse.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: LightFrame3IECOM - {43D29D14-460E-4F3A-9037-E60F11EF12F0} - C:\WINDOWS\system32\LightFrame3IECOM.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {D0A7DFA0-BB45-4B3A-97BA-419C7DE4A303} - C:\WINDOWS\system32\pmkji.dll (file missing)
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk.disabled
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: winemx32 - C:\WINDOWS\SYSTEM32\winemx32.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
  
  0
  
  Réagir
Réponse 16 / 16
Regis59 Contributeur sécurité
Salut,

Rend toi sur ce site :
http://www.virustotal.com/xhtml/virustotal_en.html
Clik sur parcourir
Recherche ceci :
C:\WINDOWS\SYSTEM32\qomkkii.dll
Clik send et colle le rapport stp

A+

0

Réagir
1. victorbravo Auteur
  
  salut Regis59, voici le rapport virustotal.
  j'attends tes conseils.
  je te remecie de ton aide
  
  0
  
  Réagir
2. victorbravo Auteur
  
  resalut, voici mon rapport A2 :
  Version - a-squared Free 2.1
  
  Réglages Scan:
  
  Objets: Mémoire, Traces, Cookies, C:\, D:\, E:\
  Scan archives: Marche
  Heuristiques: Marche
  Scan ADS: Marche
  
  Début du scan: 25/11/2006 18:29:39
  
  C:\Documents and Settings\fab\Cookies\fab@weborama[1].txt Détecter: Trace.TrackingCookie
  C:\Documents and Settings\fab\Local Settings\Application Data\Mozilla\Firefox\Profiles\3hccf3yv.default\Cache\633285D9d01/Reboot.exe Détecter: Riskware.RiskTool.Win32.Reboot.f
  C:\Documents and Settings\fab\Local Settings\Temporary Internet Files\Content.IE5\JGFSTBKS\srvghi[1].exe Détecter: Heuristic.Dialer
  C:\Documents and Settings\fab\Mes documents\Mes téléchargements\SmitfraudFix\SmitfraudFix\Reboot.exe Détecter: Riskware.RiskTool.Win32.Reboot.f
  C:\Documents and Settings\fab\Mes documents\Mes téléchargements\SmitfraudFix.zip/Reboot.exe Détecter: Riskware.RiskTool.Win32.Reboot.f
  C:\WINDOWS\Temp\idd1D4.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\idd5237.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\idd63F5.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddA2D1.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddA380.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddC7C9.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddC7CE.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddC7F3.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddC816.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddC847.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\iddC86A.tmp.exe Détecter: Heuristic.Dialer
  C:\WINDOWS\Temp\win1D2.tmp.exe Détecter: Heuristic.Dialer
  
  Scanné
  
  Fichiers: 203756
  Traces: 84481
  Cookies: 22
  Processus: 25
  
  Trouver
  
  Fichiers: 16
  Traces: 0
  Cookies: 1
  Processus: 0
  Clés de Registre: 0
  
  Fin du Scan: 25/11/2006 19:15:39
  Temps du Scan: 00:46:00
  et mon rapport smitfraud:
  SmitFraudFix v2.124
  
  Rapport fait à 18:17:11,89, 25/11/2006
  Executé à partir de C:\Documents and Settings\fab\Mes documents\Mes t‚l‚chargements\SmitfraudFix\SmitfraudFix
  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
  Fix executé en mode normal
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\fab
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\fab\Application Data
  
  »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\fab\Favoris
  
  »»»»»»»»»»»»»»»»»»»»»»»» Bureau
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
  
  »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  
  »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
  
  »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Fin.
  j'espere que ça aidera.
  merci
  
  0
  
  Réagir

Win59.tmp.exe?

16 réponses

Discussions similaires

Newsletters