Dialer et virus

Bonjour tout le monde j'ai un problème , il ya un message dialer qui me dit tout d'abord : Connessione impossibile ! Il programma sarà terminato. Puis apres apparait ce message : Il software di connessione-navigazione. QUESTO SOFTWARE E' ESENTE DA VIRUS AL 100%. Attenzione! procedendo accetti le condizioni di utilizzo del software e dichiari di aver compiuto 18 anni. Il costo del collegamento e' di un euro e novanta centesimi (euro 1.99) al minuto IVA INCLUSA piu' zero euro (euro 00.31) di scatto alla risposta, la durata della connessione e' di venti minuti (20 min) consecutivi. Se accetti clicca sul: SI. BUON DIVERTIMENTO !

Pourriez vous m'aider à enlever ce dialer tres embetant j'en suis au bout du rouleau !!! Merci d'avance!

PS: J'ai d'autres virus si vous pouvez m'aider à les résoudre je serais très content!

Bonjour.

I) Télécharge Ewido V4.

Lancer Ewido puis :

a) Le mettre à jour en cliquant update now.
b) Redémarrer en mode sans échec Si tu ne sais pas comment faire vas voir sur cette page
c) Dans l'onglet "Scanner", aller dans Settings puis sous "How to act" choisir Quarantine
d) Maitenant dans l'onglet "Scanner", choisir le "complete system scan".
e) A la fin du scan, cliquer seulement sur : "Apply all actions"
f) Ensuite, cliquer sur "Save Report " puis "Save report as", enregistrer le rapport dans les documents et redémarrer normalement.


Si tu as des problèmes et avant de poser une question sur l'utilisation de ce logiciel, regarder ce tuto explicatif by Rub_Mic.





II) Télécharge HijackThis et clique sur "Do a system scan only". A la fin du scan fait "save log" et enregistre le sur ton bureau,post le ensuite en fesant un copier-coller



[ Ce message a été modifié par : : freeman206 le 06-09-2006 15:39 ]

Salut merci de m'aider! Voilà l'analyse ewido:

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 17:37:49 06/09/2006

+ Scan result:



C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0036933.exe -> Adware.Craagle : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0037389.exe -> Adware.Craagle : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0041695.exe -> Adware.Craagle : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0036997.dll -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0037000.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0037001.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0040897.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0040898.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0041694.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0041698.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0041693.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0041722.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\WINDOWS\system32\khfeffc.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd1.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd10.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd23.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd2B.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd39.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd3B.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd3E.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd40.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd45.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd49.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd4A.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd4D.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd50.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd8.tmp.exe -> Dialer.Agent.z : Cleaned with backup (quarantined).
C:\!KillBox\win24.tmp -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\Local Settings\Temporary Internet Files\Content.IE5\9ST3MNO7\srvhng[1].exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\Local Settings\Temporary Internet Files\Content.IE5\EF6S3G3Z\srvekr[1].exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win22.tmp.exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win24.tmp.exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win2A.tmp.exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win38.tmp.exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win3A.tmp.exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win3D.tmp.exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win3F.tmp.exe -> Dialer.IDialer.m : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win12.tmp.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0034493.exe -> Not-A-Virus.HackTool.Win32.Homac : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\DoctorWeb\Quarantine\A0034492.exe -> Not-A-Virus.HackTool.Win32.MSNPass.b : Cleaned with backup (quarantined).
:mozilla.52:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.53:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.57:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.58:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.59:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.30:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.19:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
:mozilla.49:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.50:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.51:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.25:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.21:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.22:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.23:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.60:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.20:C:\Documents and Settings\Julien Dauzet\Application Data\Mozilla\Firefox\Profiles\hlcnuw3i.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd18.tmp.exe -> Trojan.Dialer.qy : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd20.tmp.exe -> Trojan.Dialer.qy : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\idd36.tmp.exe -> Trojan.Dialer.qy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\winrzf32.dll -> Trojan.Mezzia : Cleaned with backup (quarantined).
C:\Documents and Settings\Julien Dauzet\Local Settings\Temporary Internet Files\Content.IE5\CJ8XCR1F\srvenp[1].exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win16.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win1F.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).


::Report end

Par contre quand je fais un rapport hijackthis, le rapport se fait normalement mais quand je fais "save log" et bhen la fenetre se ferme et avast m'indique un adward donc à chaque fois je le supprime et ca me met une fenetre qui dit si on veut envoyer ou pas un rapport d'erreur avec hijackthis!

Bonjour.

Désactive avast le temps du scan avec HijackThis.

Bonjour ! :) Voilà le scan:

Logfile of HijackThis v1.99.1
Scan saved at 19:10:11, on 07/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\ismini.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\program files\mcafee.com\agent\mcupdate.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Julien Dauzet\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.fr/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\MediaExe\PreODM.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [OSCD_Creator] c:\Dell\MediaExe\PreODM.EXE /2
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Documents and Settings\Julien Dauzet\Bureau\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Documents and Settings\Julien Dauzet\Bureau\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E7592FD-1297-4F42-81E2-EBEA4C7EBCDF}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

Bonsoir.


Télécharge SmitFraudfix par S!Ri : http://siri.urz.free.fr/Fix/SmitfraudFix.zip

a) Dezippe le fichier "smitfraudfix.zip" sur le bureau.

b) Double clique sur l'icône "smitfraudfix.cmd" .

c) Sélectionne l'option 1 ( intitulé "recherche" ) et presse la touche Entrée.

d) Enregistre et post le rapport.

SmitFraudFix v2.83

Rapport fait à 19:34:03,98, 07/09/2006
Executé à partir de C:\Documents and Settings\Julien Dauzet\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ishost.exe PRESENT !
C:\WINDOWS\system32\components\flx?.dll PRESENT !
C:\WINDOWS\system32\components\flx??.dll PRESENT !
C:\WINDOWS\system32\components\flx???.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Julien Dauzet\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JULIEN~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonsoir.

I) Avec SmitFraudFix :

a) Redemarre en mode sans echec (tapotte la touche F8 au démarrage du système).

b) Double clique sur l'icône "smitfraudfix.cmd".

c) Sélectionne l'option 2 ( "intitulé Nettoyage") et presse Entrée.

d) Réponds par l'affirmative (o) aux questions qui te dont posées. Sauvegarde le rapport.

e) Redémarre ensuite normalement et post le rapport.





II) Post un nouveau log HijackThis.

nullMcaffy vient de me dire qu'un des fichier qui etait infecté par un virus a été nettoyer au moment ou j'ai redémarrer c'ets une bonne nouvelle!:)

1)SmitFraudFix v2.83

Rapport fait à 19:59:03,92, 07/09/2006
Executé à partir de C:\Documents and Settings\Julien Dauzet\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\ishost.exe supprimé

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

2)Logfile of HijackThis v1.99.1
Scan saved at 20:08:26, on 07/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Documents and Settings\Julien Dauzet\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.fr/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\MediaExe\PreODM.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [OSCD_Creator] c:\Dell\MediaExe\PreODM.EXE /2
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Documents and Settings\Julien Dauzet\Bureau\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Documents and Settings\Julien Dauzet\Bureau\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E7592FD-1297-4F42-81E2-EBEA4C7EBCDF}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

Bonsoir.

I) Ton log est propre.


II) Fais un scan antivirus en ligne avec IE : http://www.pandasoftware.fr/Activescan/Activescan.html. Enregistre et post ensuite le rapport. (Si tu as Avast désactive le le temps du scan).