pc infecté de spyware [Résolu]

[jawax]

bonjour,


j'explique mon cas, a chaque fois j'ai une fenêtre qui s'affiche comme quoi j'ai un virus et quand je clique dessus ça me renvoi sur le net pour acheter des antispyware.

donc mon pc est infecter de spyware.j'ai fait un rapport hijackthis que voici:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:49:44, on 14/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesPanda SecurityPanda Antivirus 2008pavsrv51.exe
C:Program FilesPanda SecurityPanda Antivirus 2008AVENGINE.EXE
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32
vsvc32.exe
C:Program FilesPanda SecurityPanda Antivirus 2008PsCtrls.exe
C:Program FilesFichiers communsPanda SoftwarePavShldpavprsrv.exe
C:WINDOWSsystem32PnkBstrA.exe
C:Program FilesPanda SecurityPanda Antivirus 2008PsImSvc.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesMSN Messengerusnsvc.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre1.6.0_04injusched.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSvVX1000.exe
C:Program FilesPanda SecurityPanda Antivirus 2008APVXDWIN.EXE
C:WINDOWSsystem32 undll32.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesSteamSteam.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSsystem32adclyraf.exe
C:Program FilesPanda SecurityPanda Antivirus 2008WebProxy.exe
C:Program FilesSteamGameOverlayUI.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSSystem32svchost.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesSteamGameOverlayUI.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesPanda SecurityPanda Antivirus 2008psimreal.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.daemon-search.com/startpage

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O3 - Toolbar: etlrlws - {25485FED-AF05-4B71-A543-BB24FCECA3DD} - C:WINDOWSetlrlws.dll
O4 - HKLM..Run: [JMB36X IDE Setup] C:WINDOWSRaidToolxInsIDE.exe
O4 - HKLM..Run: [36X Raid Configurer] C:WINDOWSsystem32xRaidSetup.exe boot
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_04injusched.exe"
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [DVDUpgrade] DVDUpgrd.exe /async
O4 - HKLM..Run: [VX1000] C:WINDOWSvVX1000.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto
O4 - HKLM..Run: [Secure] C:WINDOWSWindowsUpdates.exe
O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda SecurityPanda Antivirus 2008APVXDWIN.EXE" /s
O4 - HKLM..Run: [18c358af] rundll32.exe "C:WINDOWSsystem32mcegimpp.dll",b
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Steam] "C:Program FilesSteamSteam.exe" -silent
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 - HKCU..Run: [kvqzdprd] C:WINDOWSsystem32adclyraf.exe
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Global Startup: msn_0803_upd041807.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:Program FilesYahoo!Commonyinsthelper.dll
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:Program FilesMicrosoft OfficeOffice12GrooveSystemServices.dll
O23 - Service: Window Net Dns (MyDNS) - Unknown owner - C:Program FilesOutlook Expresssvchost.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda SecurityPanda Antivirus 2008PsCtrls.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesFichiers communsPanda SoftwarePavShldpavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda SecurityPanda Antivirus 2008pavsrv51.exe
O23 - Service: PnkBstrA - Unknown owner - C:WINDOWSsystem32PnkBstrA.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda SecurityPanda Antivirus 2008PsImSvc.exe

--
End of file - 6545 bytes





merci d'avance


cordialement

[r@in | b0w]

Bonjour.

En effet, petite infection.

Pour commencer, tu vas donc noter ces lignes.

C:WINDOWSsystem32adclyraf.exe
O3 - Toolbar: etlrlws - {25485FED-AF05-4B71-A543-BB24FCECA3DD} - C:WINDOWSetlrlws.dll
O4 - HKLM..Run: [Secure] C:WINDOWSWindowsUpdates.exe
O4 - HKLM..Run: [18c358af] rundll32.exe "C:WINDOWSsystem32mcegimpp.dll",b
O4 - HKCU..Run: [kvqzdprd] C:WINDOWSsystem32adclyraf.exe
O4 - Global Startup: msn_0803_upd041807.exe
O23 - Service: Window Net Dns (MyDNS) - Unknown owner - C:Program FilesOutlook Expresssvchost.exe (file missing)

Tu redémarres ensuite en Mode sans échec (primordial pour tout enlever) puis tu cliques sur Fix Checked.

Je te conseille ensuite de refaire une analyse en renommant HiJackThis.exe en quelque chose d'autre, certaines vermines savent le reconnaître.

Si tu as besoin d'informations, regardes ce tutorial.

Bonne chasse.

[jawax]

ok, merci de ton aide

[r@in | b0w]

Re.

Ton ordinateur va mieux?

Fais un nouveau scan pour en être sur et postes le rapport.

Je me méfie de la vermine.

[jawax]

re.

mon pc a l'air d'aller un peut mieux, après faut voir par la suite.


le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:49:42, on 14/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesPanda SecurityPanda Antivirus 2008pavsrv51.exe
C:Program FilesPanda SecurityPanda Antivirus 2008AVENGINE.EXE
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32
vsvc32.exe
C:Program FilesPanda SecurityPanda Antivirus 2008PsCtrls.exe
C:WINDOWSExplorer.EXE
C:Program FilesFichiers communsPanda SoftwarePavShldpavprsrv.exe
C:WINDOWSsystem32PnkBstrA.exe
C:Program FilesPanda SecurityPanda Antivirus 2008PsImSvc.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesPanda SecurityPanda Antivirus 2008ApvxdWin.exe
C:Program FilesJavajre1.6.0_04injusched.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSvVX1000.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSTEMPBNE.tmp
C:WINDOWSSystem32svchost.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:Program FilesSteamSteam.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesPanda SecurityPanda Antivirus 2008WebProxy.exe
C:Program FilesMSN Messengerusnsvc.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesPanda SecurityPanda Antivirus 2008psimreal.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.daemon-search.com/startpage

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O4 - HKLM..Run: [JMB36X IDE Setup] C:WINDOWSRaidToolxInsIDE.exe
O4 - HKLM..Run: [36X Raid Configurer] C:WINDOWSsystem32xRaidSetup.exe boot
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_04injusched.exe"
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [DVDUpgrade] DVDUpgrd.exe /async
O4 - HKLM..Run: [VX1000] C:WINDOWSvVX1000.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda SecurityPanda Antivirus 2008APVXDWIN.EXE" /s
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Steam] "C:Program FilesSteamSteam.exe" -silent
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:Program FilesYahoo!Commonyinsthelper.dll
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:Program FilesMicrosoft OfficeOffice12GrooveSystemServices.dll
O23 - Service: Window Net Dns (MyDNS) - Unknown owner - C:Program FilesOutlook Expresssvchost.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda SecurityPanda Antivirus 2008PsCtrls.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesFichiers communsPanda SoftwarePavShldpavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda SecurityPanda Antivirus 2008pavsrv51.exe
O23 - Service: PnkBstrA - Unknown owner - C:WINDOWSsystem32PnkBstrA.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda SecurityPanda Antivirus 2008PsImSvc.exe

--
End of file - 5844 bytes

[r@in | b0w]

Re.

Deux lignes encore:

O23 - Service: Window Net Dns (MyDNS) - Unknown owner - C:Program FilesOutlook Expresssvchost.exe (file missing)
C:WINDOWSTEMPBNE.tmp

Sinon, un petit Nettoyage et tout ira bien

[jawax]

ok. merci

[r@in | b0w]

De rien

N'oublies pas de rajouter en respectant la casse [Résolu] dans le titre en éditant ton premier message.