bonjour,

j'ai un problem de fenetres qui se ferment toutes seules et mon antivirus avast declare qu'il existe un killer.exe sous windows.

apres avoir lu sur ce type de problem voila mon rapport:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:01:52, on 12/04/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\drivers\STDSB.exe

C:\WINDOWS\system32\drivers\Icon.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\WINDOWS\smss.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\crypserv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

e:\ElsaWin\bin\LcSvrAdm.exe

e:\ElsaWin\bin\LcSvrDba.exe

e:\ElsaWin\bin\LcSvrHis.exe

e:\ElsaWin\bin\LcSvrPas.exe

e:\ElsaWin\bin\LcSvrSaz.exe

e:\ElsaWin\bin\VSgate.exe

C:\PROGRA~1\VIVIDW~1\WORKSH~1.EXE

C:\Program Files\InternetEverywhere\WTGService.exe

C:\Program Files\Vivid WorkshopData ATI\jre\bin\java.exe

C:\WINDOWS\system32\wuauclt.exe

e:\ElsaWin\bin\LcSvrAuf.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\ntvdm.exe

C:\Documents and Settings\makram\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\makram\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\makram\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\InternetEverywhere\InternetEverywhere.exe

C:\Program Files\InternetEverywhere\Launcher.exe

C:\Documents and Settings\makram\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\makram\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: Shell=explorer.exe, killer.exe

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe

O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [Runonce] C:\WINDOWS\smss.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O13 - Gopher Prefix:

O17 - HKLM\System\CCS\Services\Tcpip\..\{B59D8FE1-0791-486D-A245-41C75E346928}: NameServer = 10.12.4.17 193.95.123.252

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O18 - Protocol: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - e:\ElsaWin\bin\wiProt.dll

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: ELSA Administration Service (LcSvrAdm) - Volkswagen AG - e:\ElsaWin\bin\LcSvrAdm.exe

O23 - Service: ELSA Auftragsverwaltungs Service (LcSvrAuf) - Volkswagen AG - e:\ElsaWin\bin\LcSvrAuf.exe

O23 - Service: ELSA DBA Server (LcSvrDba) - Volkswagen AG - e:\ElsaWin\bin\LcSvrDba.exe

O23 - Service: ELSA Historie Server (LcSvrHis) - Volkswagen AG - e:\ElsaWin\bin\LcSvrHis.exe

O23 - Service: ELSA PASS Server (LcSvrPAS) - Volkswagen AG - e:\ElsaWin\bin\LcSvrPas.exe

O23 - Service: ELSA APOSpro Server (LcSvrSaz) - Volkswagen AG - e:\ElsaWin\bin\LcSvrSaz.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: ELSA Vaudis Service (VSGate) - Volkswagen AG - e:\ElsaWin\bin\VSgate.exe

O23 - Service: WorkshopDBService - Acresso - C:\PROGRA~1\VIVIDW~1\WORKSH~1.EXE

O23 - Service: WTGService - Unknown owner - C:\Program Files\InternetEverywhere\WTGService.exe

--

End of file - 9416 bytes

finga

Ton Hiajckthis est une vieille version.Suis ce tuto(en images) et poste les rapports ici à la suite:

https://forum.pcastuces.com/aide_au_diagnostic_un_pc_infecte_pcastuces-f25s17490.htm

merci je le ferai !!

Salut,

Si je peux te donner un conseil : ne traîne pas trop car une grosse infection compromet ta machine et la sûreté de tes données...

Fill

Fichier joint : ZHPDiag.txt

merci pour le conseil j'essairai quand meme mais cet fois avec la nouvelle procedure.

voila le repport ( c'est celui d'un autre Pc )

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Version de la base de données: 6354

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

14/04/2011 00:21:09

mbam-log-2011-04-14 (00-20-55).txt

Type d'examen: Examen rapide

Elément(s) analysé(s): 161307

Temps écoulé: 24 minute(s), 3 seconde(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 1

Clé(s) du Registre infectée(s): 21

Valeur(s) du Registre infectée(s): 1

Elément(s) de données du Registre infecté(s): 1

Dossier(s) infecté(s): 4

Fichier(s) infecté(s): 11

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

c:\WINDOWS\system32\cgmopenbho.dll (Trojan.BHO) -> No action taken.

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (Adware.VideoEgg) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (Adware.VideoEgg) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5041FD9-4819-4DC4-B20E-C950B5B03D2A} (Adware.VideoEgg) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{E596DF5F-4239-4D40-8367-EBADF0165917} (Rogue.Installer) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cont_dcads (Adware.AdRotator) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\bisoft (Worm.Bagle) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\VideoEgg (Adware.VideoEgg) -> No action taken.

HKEY_CURRENT_USER\Software\EoRezo (Rogue.Eorezo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56B38F40-4E70-11d4-A076-0080AD86BA2F} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{56B38F40-4E70-11d4-A076-0080AD86BA2F} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\TypeLib\{56B38F41-4E70-11D4-A076-0080AD86BA2F} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{56B38F42-4E70-11D4-A076-0080AD86BA2F} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\WebCGMHlprObj.WebCGMHlprObj.1 (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\WebCGMHlprObj.WebCGMHlprObj (Trojan.BHO) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{56B38F40-4E70-11D4-A076-0080AD86BA2F} (Trojan.BHO) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{56B38F40-4E70-11D4-A076-0080AD86BA2F} (Trojan.BHO) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ed760f8e-e577-e9a2-acb7-cdac31cda686} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{ed760f8e-e577-e9a2-acb7-cdac31cda686} (Trojan.BHO) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ED760F8E-E577-E9A2-ACB7-CDAC31CDA686} (Trojan.BHO) -> No action taken.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\SYSTEM32\CGMOPENBHO.DLL (Trojan.BHO) -> Value: CGMOPENBHO.DLL -> No action taken.

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):

c:\documents and settings\Foura\application data\drivers\downld (Worm.Bagle) -> No action taken.

c:\documents and settings\all users\application data\VideoEgg (Adware.VideoEgg) -> No action taken.

c:\program files\eoRezo (Rogue.Eorezo) -> No action taken.

c:\program files\eoRezo\EoAdv (Rogue.Eorezo) -> No action taken.

Fichier(s) infecté(s):

c:\program files\mozilla firefox\components\nsdcads.dll (Adware.AdRotator) -> No action taken.

c:\WINDOWS\system32\cont_dcads-remove.exe (Adware.AdRotator) -> No action taken.

c:\WINDOWS\logfile32.txt (Malware.Trace) -> No action taken.

c:\documents and settings\all users\application data\VideoEgg\user.dat (Adware.VideoEgg) -> No action taken.

c:\program files\eoRezo\cmhost.cyp (Rogue.Eorezo) -> No action taken.

c:\program files\eoRezo\eorezoimg_9.dll (Rogue.Eorezo) -> No action taken.

c:\program files\eoRezo\eorezotools_9.dll (Rogue.Eorezo) -> No action taken.

c:\program files\eoRezo\EoAdv\eoAdv.url (Rogue.Eorezo) -> No action taken.

c:\program files\eoRezo\EoAdv\eorezobho.old (Rogue.Eorezo) -> No action taken.

c:\WINDOWS\system32\cgmopenbho.dll (Trojan.BHO) -> No action taken.

c:\WINDOWS\system32\25e40152-27e9-70ce-f25f-0a0e6df578f7.dll (Trojan.BHO) -> No action taken.

Salut Finga,

tu as une infection par Bagle, qui s'attrape par des cracks piégés. Généralement, quand je vois ça, je n'apporte pas d'assitance.

Commence par virer tous tes cracks/keygens et je te donne la suite. C'est non négociable.

Fill