Suppression de WinFixer

storm57 · le 28 octobre 2005

Hello

Apparemment comme beaucoup d'autre personnes, j'ai quelques soucis pour supprimer WinFixer. J'ai suivi la procédure *** HIJACKTHIS *** de Monsieur Pollux ( http://forum.zebulon.fr/index.php?showtopic=73227)

J'ai donc déjà procédé à un "pré-nettoyage" de mon PC. Voici mon logfile HijackThis

Logfile of HijackThis v1.99.1

Scan saved at 21:43:47, on 28.10.2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Laurent\Bureau\HijackThis_1_99_1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/index_f.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.ch

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/index_f.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O1 - Hosts: stx11.sextracker.com

O1 - Hosts: 127

O1 - Hosts: earch200.com

O1 - Hosts: 127

O1 - Hosts: earch200.com

O1 - Hosts: 127

O1 - Hosts: cking.info

O1 - Hosts: om

O1 - Hosts: icktracking.info

O1 - Hosts: piderbait.com

O1 - Hosts: om

O1 - Hosts: icktracking.info

O1 - Hosts: piderbait.com

O1 - Hosts: om

O1 - Hosts: icktracking.info

O1 - Hosts: 127.0.0

O1 - Hosts: henu.com

O1 - Hosts: 0.com

O1 - Hosts: .net

O1 - Hosts: 0.com

O1 - Hosts: .net

O1 - Hosts: 12

O1 - Hosts: rch.com

O1 - Hosts: time.com

O1 - Hosts: 12

O1 - Hosts: rch.com

O1 - Hosts: nfo

O1 - Hosts: 127

O1 - Hosts: .rgs2.net

O1 - Hosts: 127

O1 - Hosts: nfo

O1 - Hosts: 127

O1 - Hosts: .rgs2.net

O1 - Hosts: 127

O1 - Hosts: nfo

O1 - Hosts: 12

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: e.net

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: e.net

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: e.net

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: ar.com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: op2.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: ogy.com

O1 - Hosts: ator.com

O1 - Hosts: op2.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\system32\1031\libwave.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKLM\..\Run: [NI.UWAS5LP_0001_0811] "I:\WAS5Scan.exe"

O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe

O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sB Audigy 2 Startup Menu] /L:FRN

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Free Launcher] "C:\Program Files\Free Launcher\FreeLauncher.exe" /m

O4 - Global Startup: Adobe Gamma Loader.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .fpx: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT34.dll

O12 - Plugin for .ivr: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT34.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1103228390750

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{3F3525FD-1B47-4328-9B8D-9FB28488B9EA}: NameServer = 10.0.0.20

O17 - HKLM\System\CS1\Services\Tcpip\..\{3F3525FD-1B47-4328-9B8D-9FB28488B9EA}: NameServer = 10.0.0.20

O18 - Protocol: IW - {F4CB1DC2-BF71-42F5-81AB-4606998A6B56} - C:\Program Files\Walker\ImageWalker220\ImageWalkerHtml.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: libwave - C:\WINDOWS\system32\1031\libwave.dll

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Merci d'avance!

le 28 octobre 2005

Bonsoir et bienvenue sur Zeb'Sécu. Je regarde ton rapport, réponse dans quelques instants.

Tu as deux antivirus, désinstalles-en un.

Télécharge:

Hoster de Toadbee:

http://www.funkytoad.com/download/hoster.zip

EasyCleaner de Toni Helenius

http://personal.inet.fi/business/toniarts/ecleane.htm

Démarre en mode sans échec (F8 ou F5)

Démarre HijackThis Do a system scan only, assure toi que la case Make Backups before fixing items est activée et coche les lignes suivantes:

O1 - Hosts: stx11.sextracker.com

O1 - Hosts: 127

O1 - Hosts: earch200.com

O1 - Hosts: 127

O1 - Hosts: earch200.com

O1 - Hosts: 127

O1 - Hosts: cking.info

O1 - Hosts: om

O1 - Hosts: icktracking.info

O1 - Hosts: piderbait.com

O1 - Hosts: om

O1 - Hosts: icktracking.info

O1 - Hosts: piderbait.com

O1 - Hosts: om

O1 - Hosts: icktracking.info

O1 - Hosts: 127.0.0

O1 - Hosts: henu.com

O1 - Hosts: 0.com

O1 - Hosts: .net

O1 - Hosts: 0.com

O1 - Hosts: .net

O1 - Hosts: 12

O1 - Hosts: rch.com

O1 - Hosts: time.com

O1 - Hosts: 12

O1 - Hosts: rch.com

O1 - Hosts: nfo

O1 - Hosts: 127

O1 - Hosts: .rgs2.net

O1 - Hosts: 127

O1 - Hosts: nfo

O1 - Hosts: 127

O1 - Hosts: .rgs2.net

O1 - Hosts: 127

O1 - Hosts: nfo

O1 - Hosts: 12

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: e.net

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: e.net

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: e.net

O1 - Hosts: 7.0.0.1 qcksea

O1 - Hosts: d.com

O1 - Hosts: king.info

O1 - Hosts: ar.com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: op2.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

O1 - Hosts: com

O1 - Hosts: rchtoolbar.com

O1 - Hosts: ogy.com

O1 - Hosts: ator.com

O1 - Hosts: op2.com

O1 - Hosts: singles.com

O1 - Hosts: rscope.com

O1 - Hosts: timizer.com

Ferme toutes les fenêtres, tous les programmes et clique sur Fix checked

Exécute EasyCleaner Inutiles et Registre seulement. Ne pas toucher à la fonction doublon.

Redémarre normalement, ouvre Hoster, clique sur 'Restore original Hosts' et poste un nouveau rapport HijackThis pour vérification.

NB: Il y a d'autres infections...

Modifié le 28 octobre 2005 par Stonangel

storm57 · le 2 novembre 2005

Salut! Merci pour ta réponse (très) rapide, mais je n'ai rallumé mon PC que ce soir... J'ai suivi tes instructions et voici mon nouveau rapport HijackThis (j'ai oublié de le faire en mode sans échec..):

Logfile of HijackThis v1.99.1

Scan saved at 20:11:09, on 02.11.2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe

C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe

C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Documents and Settings\Laurent\Bureau\HijackThis_1_99_1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/index_f.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.ch

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/index_f.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =