Plusieurs virus

Résolu
ludodu68 -  
Bonsoir , j'ai des message d'alerte qui arrete pas de s'affiché dissant virus "network worm" et spyware "cyberlog-x"
et un virus " w32.myzor.fk@yf" et des trojans et des malware
AU SECOURS
Configuration: Windows XP
Internet Explorer 7.0

35 réponses

Résumé de la discussion

Des messages d'alerte signalant des virus, notamment un network worm, un spyware cyberlog-x et un virus W32.Myzor.fk@yf, apparaissent sous Windows XP avec Internet Explorer 7. Plusieurs propositions techniques mettent en avant l’analyse via HijackThis et l’examen de rapports de scan pour repérer les entrées suspectes et déterminer les composants malveillants. Les discussions évoquent des outils comme Vundo, des conseils pour réactiver l’antivirus Avast et des ajustements au démarrage pour contenir l’infection. En dernier, des dépistages répétés et des scans à refaire après réinstallation d’antivirus sont recommandés.

Bobot (l’IA à votre service)
  1. ep44 Contributeur
    Bonjour

    Télécharge sur le bureau
    ftp://ftp.commentcamarche.com/download/HJTInstall.exe
    = Clic-droit sur Hijackthis
    = Extraire ici ( ou extraire sans confirmation ou tout ou unzip)
    = clic droit sur Hijackthis ==> renommer ==> écrire : test.exe ( à la place de hijackthis.exe) <== Important
    =Double-clic dessus
    = Clic Do a system scan and save the log
    =coller le rapport
    si problème voir l'aide
    [url=https://forums.cnetfrance.fr]Aide hijackthis[/url]
    0
    1. ludodu68 Auteur
      merci pour ton aide tou fonctionne normalement
      0
  2. cgui33
    Salut ep44
    Y aurait-il des virus qu bloqueraient des logiciels tels que HijackThis ?
    On en apprends vraiment tous les jours !
    As tu déjà vu ce genre de procédé ?
    De toutes façons il est vrai que ça ne mange pas de pain de le renommer ...
    Remarque interessante !
    A+
    0
    1. ludodu68 Auteur
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 21:21:45, on 12/11/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16544)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Microsoft LifeCam\MSCamS32.exe
      C:\WINDOWS\System32\HPZipm12.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
      C:\PROGRA~1\INCRED~1\bin\IMApp.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\evzudmca.dll
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE12\EXCEL.EXE/3000
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
      O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
      O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
      O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
      O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
      O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
      O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00A7D00.dat
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
      O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
      O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
      0
      1. ludodu68 Auteur
        CA ARETE PAS DE PLANTER ARRRRRRRRRRRRRRRRRRRRRRRRR
        0
        2. ep44 Contributeur
          Télécharge sur le Bureau.
          [url=http://www.atribune.org/ccount/click.php?id=4]vundofix|/url]

          => Double-clic VundoFix.exe.
          => Clic OK
          => Attendre le redemarrage de Vundofix
          => Clic Scan for Vundo
          => Le scan est assez long , à la fin
          => Clic Remove Vundo
          => Puis yes
          => Le Bureau disparaît un moment lors de la suppression des fichiers.
          => Message shutdown
          => clic OK
          => Redémarrage auto
          => copier le rapport qui est dans C:vundofix.txt

          Télécharge sur le bureau
          [url=http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe]virtumundoBeGone[/url]

          => Double clic sur VirtumundoBeGone.exe
          => Clic Continue ==> clic Start
          => Clic Oui
          => A la fin si Vundo est présent , le PC s’éteint et redémarre
          - Si Ecran bleu et message : Erreur fatale .. pas de problème
          => Poster le rapport VBG.TXT qui est sur le bureau
          0
          1. ludodu68 Auteur
            impossible d'ouvrir le lien vundo recheche de la page puis plante
            obligé de redémaré
            virtumundo pas de probleme je le fait quand meme?
            0
            1. ep44 Contributeur
              il faut vraiment faire vundo
              0
              1. ludodu68 Auteur
                voila deja pour vundo
                C:\WINDOWS\system32\evzudmca.dll
                at je fait virtumundo
                0
                1. ludodu68 Auteur
                  et voissi virtu
                  11/12/2007, 22:36:23] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ludo\Bureau\VirtumundoBeGone.exe" )
                  [11/12/2007, 22:36:35] - Detected System Information:
                  [11/12/2007, 22:36:35] - Windows Version: 5.1.2600, Service Pack 2
                  [11/12/2007, 22:36:35] - Current Username: ludo (Admin)
                  [11/12/2007, 22:36:35] - Windows is in NORMAL mode.
                  [11/12/2007, 22:36:35] - Searching for Browser Helper Objects:
                  [11/12/2007, 22:36:35] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
                  [11/12/2007, 22:36:35] - BHO 2: {2DD1F00D-E9B6-486C-881C-25B02168F291} ()
                  [11/12/2007, 22:36:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
                  [11/12/2007, 22:36:35] - Checking for HKLM\...\Winlogon\Notify\jkkjh
                  [11/12/2007, 22:36:35] - Key not found: HKLM\...\Winlogon\Notify\jkkjh, continuing.
                  [11/12/2007, 22:36:35] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
                  [11/12/2007, 22:36:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
                  [11/12/2007, 22:36:35] - Checking for HKLM\...\Winlogon\Notify\SDHelper
                  [11/12/2007, 22:36:35] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
                  [11/12/2007, 22:36:35] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
                  [11/12/2007, 22:36:35] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
                  [11/12/2007, 22:36:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
                  [11/12/2007, 22:36:35] - No filename found. Continuing.
                  [11/12/2007, 22:36:35] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
                  [11/12/2007, 22:36:35] - BHO 7: {f37ebdd4-8ae2-4d04-96f3-e0c61870c768} ()
                  [11/12/2007, 22:36:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
                  [11/12/2007, 22:36:35] - Checking for HKLM\...\Winlogon\Notify\faysbvyy
                  [11/12/2007, 22:36:35] - Key not found: HKLM\...\Winlogon\Notify\faysbvyy, continuing.
                  [11/12/2007, 22:36:35] - Finished Searching Browser Helper Objects
                  [11/12/2007, 22:36:35] - Finishing up...
                  [11/12/2007, 22:36:35] - Nothing found! Exiting...
                  0
                  2. ludodu68 Auteur
                    c'est ce qu'il y a dans vbg.txt
                    [11/12/2007, 22:40:38] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ludo\Bureau\VirtumundoBeGone.exe" )
                    [11/12/2007, 22:40:41] - Detected System Information:
                    [11/12/2007, 22:40:41] - Windows Version: 5.1.2600, Service Pack 2
                    [11/12/2007, 22:40:41] - Current Username: ludo (Admin)
                    [11/12/2007, 22:40:41] - Windows is in NORMAL mode.
                    [11/12/2007, 22:40:41] - Searching for Browser Helper Objects:
                    [11/12/2007, 22:40:41] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
                    [11/12/2007, 22:40:41] - BHO 2: {2DD1F00D-E9B6-486C-881C-25B02168F291} ()
                    [11/12/2007, 22:40:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
                    [11/12/2007, 22:40:41] - Checking for HKLM\...\Winlogon\Notify\jkkjh
                    [11/12/2007, 22:40:41] - Key not found: HKLM\...\Winlogon\Notify\jkkjh, continuing.
                    [11/12/2007, 22:40:41] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
                    [11/12/2007, 22:40:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
                    [11/12/2007, 22:40:41] - Checking for HKLM\...\Winlogon\Notify\SDHelper
                    [11/12/2007, 22:40:41] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
                    [11/12/2007, 22:40:41] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
                    [11/12/2007, 22:40:41] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
                    [11/12/2007, 22:40:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
                    [11/12/2007, 22:40:41] - No filename found. Continuing.
                    [11/12/2007, 22:40:41] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
                    [11/12/2007, 22:40:41] - BHO 7: {f37ebdd4-8ae2-4d04-96f3-e0c61870c768} ()
                    [11/12/2007, 22:40:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
                    [11/12/2007, 22:40:41] - Checking for HKLM\...\Winlogon\Notify\faysbvyy
                    [11/12/2007, 22:40:41] - Key not found: HKLM\...\Winlogon\Notify\faysbvyy, continuing.
                    [11/12/2007, 22:40:41] - Finished Searching Browser Helper Objects
                    [11/12/2007, 22:40:41] - Finishing up...
                    [11/12/2007, 22:40:41] - Nothing found! Exiting...
                    0
                    2. ludodu68 Auteur
                      excuse je sui pas tres doué
                      VundoFix V6.5.11

                      Checking Java version...

                      Java version is 1.5.0.11

                      Scan started at 22:28:44 12/11/2007

                      Listing files found while scanning....

                      C:\WINDOWS\system32\evzudmca.dll

                      Beginning removal...

                      Attempting to delete C:\WINDOWS\system32\evzudmca.dll
                      C:\WINDOWS\system32\evzudmca.dll Has been deleted!

                      Performing Repairs to the registry.
                      Done!
                      0
                      1. cgui33
                        Tu peux fixer ces lignes avec HijackThis :
                        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE12\EXCEL.EXE/3000
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                        O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00A7D00.dat

                        Do a system scan only
                        Coches les lignes ci-dessus
                        Fix checked
                        A+
                        0
                        1. ludodu68 Auteur
                          parcontre a la fin de virtu mon pc na pas redémaré e aucun mesage d'érreur
                          c normal?
                          0
                          1. ludodu68 Auteur
                            je n'ai plus de message d'erreur et tout a l'air normal
                            comment pourais-je protégé mon pc ?
                            ET MILLE MERCI pour votre aide
                            ça ma tellement énnervé cet histoire que j'en oublie d'etre polie avec ceux qui m'aide
                            meme ma femme me fait la geule.
                            0
                            1. ep44 Contributeur
                              il faut refaire un nouveau hijack

                              @+
                              0
                              1. ludodu68 Auteur
                                voici
                                Logfile of Trend Micro HijackThis v2.0.2
                                Scan saved at 23:38:21, on 12/11/2007
                                Platform: Windows XP SP2 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                                Boot mode: Normal

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                C:\Program Files\Microsoft LifeCam\MSCamS32.exe
                                C:\WINDOWS\System32\HPZipm12.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\System32\MsPMSPSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                C:\WINDOWS\system32\wscntfy.exe
                                C:\Program Files\Internet Explorer\IEXPLORE.EXE
                                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
                                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                                O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
                                O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
                                O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
                                O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
                                O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
                                O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00A7D00.dat
                                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
                                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                                O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
                                O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
                                0
                            2. ep44 Contributeur
                              relance hijack et coche ceci
                              ensuite clic sur fix checked

                              O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
                              O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00A7D00.dat
                              ensuite
                              vérifie que ton antivirus est bien activé car dans ton rapport il ne me semble pas activé§
                              @+
                              0
                              1. ludodu68 Auteur
                                désolé g du réinstallé avast
                                voici le nouveau rapport
                                Logfile of Trend Micro HijackThis v2.0.2
                                Scan saved at 00:41:09, on 13/11/2007
                                Platform: Windows XP SP2 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                                Boot mode: Normal

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                C:\Program Files\Microsoft LifeCam\MSCamS32.exe
                                C:\WINDOWS\System32\HPZipm12.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\System32\MsPMSPSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                C:\PROGRA~1\INCRED~1\bin\IMApp.exe
                                C:\WINDOWS\System32\msiexec.exe
                                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                                O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
                                O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
                                O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
                                O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
                                O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00A7D00.dat
                                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
                                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                                O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
                                O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
                                0
                            3. ep44 Contributeur
                              relance hijack et coche ceci
                              ensuite clic sur fix checked
                              O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00A7D00.dat
                              ensuite

                              télécharger ceci
                              et à utiliser réguliérement

                              CCleaner
                              https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
                              un tuto pour l'aide
                              https://forums.cnetfrance.fr

                              Ad-Aware
                              https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/11643.html
                              un tuto pour l’aide
                              http://www.kachouri.com/tuto/tuto-327-ad-aware-2007--detecter-et-retirer-les-spywares.html

                              spybot
                              https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html
                              un tuto pour l'aide
                              https://www.malekal.com/spybot-search-destroy-proteger-desinfecter-pc-virus/

                              tient moi au courant
                              @+
                              0
                              1. ludodu68 Auteur
                                Bonsoir , tu ma aidé pour un virus dimanche soir
                                le probleme etait resolu
                                mais aujourd'hui j'ai de nouveau le meme probleme
                                alors j'ai tou de suite refais les meme manip. vu que j'était absent je n'ai encore rien effacé
                                voissi les raports vundo - virtumundo et hijackthis

                                vundofix

                                Scan started at 22:28:44 12/11/2007

                                Listing files found while scanning....

                                C:\WINDOWS\system32\evzudmca.dll

                                Beginning removal...

                                Attempting to delete C:\WINDOWS\system32\evzudmca.dll
                                C:\WINDOWS\system32\evzudmca.dll Has been deleted!

                                Performing Repairs to the registry.
                                Done!

                                VundoFix V6.5.11

                                Checking Java version...

                                Java version is 1.5.0.11

                                Scan started at 20:32:38 14/11/2007

                                Listing files found while scanning....

                                C:\WINDOWS\system32\xrumjayh.dll

                                Beginning removal...

                                Attempting to delete C:\WINDOWS\system32\xrumjayh.dll
                                C:\WINDOWS\system32\xrumjayh.dll Has been deleted!

                                Performing Repairs to the registry.
                                Done!

                                virtumondo

                                [11/14/2007, 20:48:11] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ludo\Bureau\VirtumundoBeGone.exe" )
                                [11/14/2007, 20:48:27] - Detected System Information:
                                [11/14/2007, 20:48:27] - Windows Version: 5.1.2600, Service Pack 2
                                [11/14/2007, 20:48:27] - Current Username: ludo (Admin)
                                [11/14/2007, 20:48:27] - Windows is in NORMAL mode.
                                [11/14/2007, 20:48:27] - Searching for Browser Helper Objects:
                                [11/14/2007, 20:48:27] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
                                [11/14/2007, 20:48:27] - BHO 2: {068507ee-e71a-4d49-964d-5b9d75e99c2c} ()
                                [11/14/2007, 20:48:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
                                [11/14/2007, 20:48:27] - Checking for HKLM\...\Winlogon\Notify\sqjyuinx
                                [11/14/2007, 20:48:27] - Key not found: HKLM\...\Winlogon\Notify\sqjyuinx, continuing.
                                [11/14/2007, 20:48:27] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
                                [11/14/2007, 20:48:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
                                [11/14/2007, 20:48:27] - Checking for HKLM\...\Winlogon\Notify\SDHelper
                                [11/14/2007, 20:48:27] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
                                [11/14/2007, 20:48:27] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
                                [11/14/2007, 20:48:27] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
                                [11/14/2007, 20:48:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
                                [11/14/2007, 20:48:27] - No filename found. Continuing.
                                [11/14/2007, 20:48:27] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
                                [11/14/2007, 20:48:27] - BHO 7: {C14BFE74-8158-4757-92F5-F020A70BCA11} ()
                                [11/14/2007, 20:48:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
                                [11/14/2007, 20:48:27] - Checking for HKLM\...\Winlogon\Notify\jkkjh
                                [11/14/2007, 20:48:27] - Key not found: HKLM\...\Winlogon\Notify\jkkjh, continuing.
                                [11/14/2007, 20:48:27] - Finished Searching Browser Helper Objects
                                [11/14/2007, 20:48:27] - Finishing up...
                                [11/14/2007, 20:48:27] - Nothing found! Exiting...

                                Logfile of Trend Micro HijackThis v2.0.2
                                Scan saved at 20:50:50, on 14/11/2007
                                Platform: Windows XP SP2 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                                Boot mode: Normal

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                                C:\WINDOWS\system32\twrjdlag.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                C:\Program Files\Microsoft LifeCam\MSCamS32.exe
                                C:\WINDOWS\System32\HPZipm12.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\System32\MsPMSPSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
                                O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
                                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                O4 - HKLM\..\Run: [a4a5a6dc] rundll32.exe "C:\WINDOWS\system32\jmsbcvtu.dll",b
                                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                                O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
                                O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
                                O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
                                O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
                                O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00F2516.dat
                                O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                O23 - Service: DomainService - - C:\WINDOWS\system32\twrjdlag.exe
                                O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
                                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                                O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
                                O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

                                End of file - 3791 bytes
                                0
                                • 1
                                • 2

                                Discussions similaires

                                Softonic,est-ce un virus ?
                                techmel1

                                6 réponses
                                Chrome://newtab
                                Nova

                                14 réponses
                                Désinstaller Softonic
                                Diguimette

                                5 réponses
                                Supprimer New Tab
                                tysaozon

                                8 réponses
                                Virus dans filezilla
                                balnelius10

                                9 réponses