Cheval de troie

Résolu
maximelev80 -  
Bonjour,

Mon antivirus trend micro vient de détecter un trojan nommé TSC_GENCLEAN . Il le supprime mais à chaque redémarrage de mon PC il revient. Sinon mon pc reçoit des pubs régulièrement.

Que puis-je faire ?
Configuration: Windows XP
Firefox 3.0.1

21 réponses

  1.  jfkpresident Contributeur sécurité
    re;

    tu peux mettre ton post en résolu STP .merci .

    @+
    0
    1. maximelev80 Auteur
      Car cette demande n'est plus d'actualité . Bonne journée !
      0
      1. jfkpresident Contributeur sécurité
        Je demande à un modo de supprimer ce topic.>>>Pourquoi ??
        0
        1. maximelev80 Auteur
          BOnjour,

          Je demande à un modo de supprimer ce topic.

          Merci et bonne journée
          0
          2. maximelev80 Auteur
            Merci Je fait tout cela
            0
            1. jfkpresident Contributeur sécurité
              Ok ,on continu ici alors . merci cyril :)
              0
              1. jfkpresident Contributeur sécurité
                re;

                -> Relance HijackThis cliques sur « scanner seulement » ou (« do a scan only »),
                coche les cases devant ces lignes :

                O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - "C:\PROGRA~1\Livecom\APPLIC~1\CommunicationAgent\Messag­er.exe" (file missing)
                O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - "C:\PROGRA~1\Livecom\APPLIC~1\CommunicationAgent\Messag­er.exe" (file missing)
                O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
                O2 - BHO: (no name) - {8CCF0308-8526-4663-97BB-6F1ED187580c} - (no file)
                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

                et ensuite ferme toutes les fenêtres actives autres que HijackThis!, navigateur inclus,
                puis clique "Fix checked"( ou « fixer objet »). Ferme HijackThis!
                --------------------------------------------------------------------------------------------------------------------------------------------------------------
                ensuite pour vérif :

                Fais ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X;

                la barre anti-popup du SP2 (en haut) va se mettre à clignoter,
                clic dessus et choisis "accepter l'active X" pour faire fonctionner le scan anti-virus.
                Une fois qu'il a terminé colle le rapport ici stp
                https://www.bitdefender.com/toolbox/
                Copie/Colle le rapport
                http://www.malekal.com/tutorial_BitDefender_AntiSpyware.php
                https://kerio.probb.fr/
                http://pageperso.aol.fr/rginformatique/mapage/defender.htm
                0
                1. maximelev80 Auteur
                  AIDEZ MOI !!!!
                  0
                  1. Utilisateur anonyme
                    Salut ,

                    T'es au courant que les gens on une vie en dehors ?

                    De plus ce n'est pas en ordonnant qu'on t'aide que tu vas obtenir de l'aide.

                    Evite les triplons aussi.

                    ++
                    0
                  2. jfkpresident Contributeur sécurité
                    @Utilisateur anonymesalut cyril , tu as avertis la modération ?j'ai vu trop tard ton message .

                    Si on doit fermer ce post dis le moi .

                    @+ JFK
                    0
                  3. Utilisateur anonyme
                    @jfkpresidentSalut ,
                    J'alerte les 2 autres pas celui la :)

                    ++

                    EDIT : trop tard le ménage à été fait.
                    0
                2. maximelev80 Auteur
                  et voilà le rapport mbam

                  Malwarebytes' Anti-Malware 1.23
                  Version de la base de données: 985
                  Windows 5.1.2600 Service Pack 2

                  22:18:47 26/07/2008
                  mbam-log-7-26-2008 (22-18-47).txt

                  Type de recherche: Examen rapide
                  Eléments examinés: 56414
                  Temps écoulé: 27 minute(s), 56 second(s)

                  Processus mémoire infecté(s): 0
                  Module(s) mémoire infecté(s): 1
                  Clé(s) du Registre infectée(s): 5
                  Valeur(s) du Registre infectée(s): 5
                  Elément(s) de données du Registre infecté(s): 2
                  Dossier(s) infecté(s): 0
                  Fichier(s) infecté(s): 27

                  Processus mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Module(s) mémoire infecté(s):
                  C:\WINDOWS\system32\opnmLbxu.dll (Trojan.Vundo) -> Delete on reboot.

                  Clé(s) du Registre infectée(s):
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{66c0a87f-8057-4733-bd07-47a71cab9177} (Trojan.Vundo) -> Delete on reboot.
                  HKEY_CLASSES_ROOT\CLSID\{66c0a87f-8057-4733-bd07-47a71cab9177} (Trojan.Vundo) -> Delete on reboot.
                  HKEY_CURRENT_USER\SOFTWARE\antivirus 2008 pro (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

                  Valeur(s) du Registre infectée(s):
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Windows Update (Backdoor.Bot) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update (Backdoor.Bot) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Media Player (Backdoor.Bot) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Windows Media Player (Backdoor.Bot) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer (Trojan.Agent) -> Quarantined and deleted successfully.

                  Elément(s) de données du Registre infecté(s):
                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnmlbxu -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnmlbxu -> Delete on reboot.

                  Dossier(s) infecté(s):
                  (Aucun élément nuisible détecté)

                  Fichier(s) infecté(s):
                  C:\WINDOWS\system32\opnmLbxu.dll (Trojan.Vundo) -> Delete on reboot.
                  C:\WINDOWS\system32\uxbLmnpo.ini (Trojan.Vundo) -> Delete on reboot.
                  C:\WINDOWS\system32\uxbLmnpo.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\opnnmJYp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\reste de la famille\Local Settings\Temp\hgGYPGYp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\levannier\Local Settings\Temp\GLK6E.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\reste de la famille\Local Settings\Temporary Internet Files\Content.IE5\U2A8J1W3\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\reste de la famille\Local Settings\Temporary Internet Files\Content.IE5\U2A8J1W3\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\qoMggFWN.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\cbXRKApn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\jkkLDtts.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ddcBSjHb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\rqRHaxVn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\nnnmljKe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\hgGvuTME.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\iifefGwV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\xxyxXOhG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ssqoOfEU.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ljJcCuvV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ljJCuVNH.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ljJCvVOh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\ljJYoPiF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\nqdwdbpu_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\nqdwdbpu_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                  C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\levannier\Local Settings\Temp\CmdLineExt02.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  C:\Documents and Settings\levannier\Local Settings\Temp\software.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                  et hijackthis

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 21:25:19, on 26/07/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Ahead\InCD\InCDsrv.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                  C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
                  C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
                  C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
                  C:\WINDOWS\system32\wscntfy.exe
                  C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                  C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                  C:\Program Files\Fichiers communs\Real\Update_OB\rnathchk.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                  C:\ATI-CPanel\atiptaxx.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Outlook Express\msimn.exe
                  C:\Documents and Settings\levannier\Local Settings\Temporary Internet Files\Content.IE5\8RCUJ650\HiJackThis[1].exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                  O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: (no name) - {8CCF0308-8526-4663-97BB-6F1ED187580c} - (no file)
                  O2 - BHO: (no name) - {A6972BE9-2496-422A-AEAE-C6FBDA8DB051} - C:\WINDOWS\system32\opnmLbxu.dll
                  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
                  O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                  O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                  O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
                  O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe -osboot
                  O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
                  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                  O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                  O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
                  O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - "C:\PROGRA~1\Livecom\APPLIC~1\CommunicationAgent\Messager.exe" (file missing)
                  O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - "C:\PROGRA~1\Livecom\APPLIC~1\CommunicationAgent\Messager.exe" (file missing)
                  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                  O14 - IERESET.INF: START_PAGE_URL=https://fr.yahoo.com/
                  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                  O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/activex/TmHcmsX.CAB
                  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                  O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                  O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
                  O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://orange.securitoo.com/ols/fscax.cab
                  O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (OD2 Music Manager) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
                  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
                  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
                  O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
                  O23 - Service: Protection Trend Micro contre les programmes espions (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
                  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                  O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
                  O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
                  O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
                  0
                  1. maximelev80 Auteur
                    Petit UP car c'est assez urgent . Je part en vacance dans quelque jour.et je n'aura pas internet. J'aimerez que ce problème soit régler avant mon départ .
                    0
                    2. maximelev80 Auteur
                      Voilà le rapport hijackthis

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 21:25:19, on 26/07/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\Ati2evxx.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Ahead\InCD\InCDsrv.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                      C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
                      C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
                      C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
                      C:\WINDOWS\system32\wscntfy.exe
                      C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                      C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
                      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                      C:\Program Files\Fichiers communs\Real\Update_OB\rnathchk.exe
                      C:\Program Files\QuickTime\qttask.exe
                      C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                      C:\ATI-CPanel\atiptaxx.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\Program Files\Outlook Express\msimn.exe
                      C:\Documents and Settings\levannier\Local Settings\Temporary Internet Files\Content.IE5\8RCUJ650\HiJackThis[1].exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
                      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                      O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
                      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                      O2 - BHO: (no name) - {8CCF0308-8526-4663-97BB-6F1ED187580c} - (no file)
                      O2 - BHO: (no name) - {A6972BE9-2496-422A-AEAE-C6FBDA8DB051} - C:\WINDOWS\system32\opnmLbxu.dll
                      O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
                      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                      O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
                      O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe -osboot
                      O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
                      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                      O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
                      O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - "C:\PROGRA~1\Livecom\APPLIC~1\CommunicationAgent\Messager.exe" (file missing)
                      O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - "C:\PROGRA~1\Livecom\APPLIC~1\CommunicationAgent\Messager.exe" (file missing)
                      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                      O14 - IERESET.INF: START_PAGE_URL=https://fr.yahoo.com/
                      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                      O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/activex/TmHcmsX.CAB
                      O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                      O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                      O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                      O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
                      O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://orange.securitoo.com/ols/fscax.cab
                      O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (OD2 Music Manager) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
                      O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
                      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                      O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
                      O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
                      O23 - Service: Protection Trend Micro contre les programmes espions (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
                      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                      O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
                      O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
                      O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
                      0
                      1. jfkpresident Contributeur sécurité
                        maximelev : Poste les deux rapports Hijackthis et MBAM .

                        MBAM est un anti-malware et Hijackthis est un outil de diagnostique de ton pc .
                        0
                        1. zorinho
                          Salut,

                          je vois deux étapes:

                          1) scan et rapport avec Hijackthis
                          2) scan et rapport avec Malwarebytes antimalware (MBAM)

                          Les deux analyses sont loin d'être contradictoires

                          Zor
                          0
                          1. maximelev80 Auteur
                            Je doit suivre quelle procédure ???
                            vous m'en avez donner 3 lol

                            Merci
                            0
                            1. jfkpresident Contributeur sécurité
                              bonsoir a tous ;

                              Zorinho : ton lien est mort pour hijack :)

                              0
                              1. zorinho
                                Merci, j'ai corrigé l'erreur
                                0
                            3. sexycamel
                              Supprime tout ce que MalwaresBytes trouvera.
                              0
                              1. Petite canelle Contributeur
                                copier-coller le rapport pour analyse.
                                0
                                1. maximelev80 Auteur
                                  Je fait quoi après le scan.
                                  0
                                  • 1
                                  • 2

                                  Discussions similaires

                                  Cheval de Troie- e.tre456.worm.windows
                                  Ninou037

                                  13 réponses
                                  Virus potentiel
                                  Ramon1

                                  29 réponses
                                  virus et ou cheval de troie
                                  FLORE+60

                                  1 réponse
                                  cheval dans oblivion
                                  sernaldo53

                                  12 réponses
                                  supprimer un cheval de troie
                                  Blandine1964

                                  10 réponses