[résolu]INFECTION trojan.vundo

Thanos · le 6 décembre 2005

peux tu regarder dans ce dossier et me dire ce qu'il y a dedans?

C:\PROGRAM FILES\Windows ControlAd

J'aimerai que tu ouvre le registre émarrer / Exécuter puis tu tapes : regedit

Vas jusqu'à la clé suivante:

HKEY_LOCAL_MACHINE>SOFTWARE> et cherche ceci:Windows AdControl

Modifié le 6 décembre 2005 par charles ingals

mazoupili · le 6 décembre 2005

Des lignes inutiles à fixer dans l'attente du rapport de scan!

Démarre Hijackthis"Do a system scan only", et coche les lignes suivantes :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [instantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe

O4 - Global Startup: FotoStation Easy AutoLaunch.lnk = C:\Program Files\FotoStation Easy\FotoStation Easy AutoLaunch.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: NkVwMon.exe.lnk = C:\Program Files\Nikon\NkView4\NkVwMon.exe

O23 - Service: Plug-n-Play SP2 Fix (sp2pnpfix) - Conexant - (no file)

Ferme toutes les fenêtres, tous les programmes et clique surFix checked

Par curiosité,va voir, et dit moi si tu trouves ce fichier:

-C:\WINDOWS\system32\pnpsp2fix.exe

Assure toi d'avoir acces à tous les fichiers=>

Non je n'ai plus ce fichier.

Thanos · le 6 décembre 2005

j'ai édité mon précédent message!

J'aimerai que tu ouvre le registre émarrer / Exécuter puis tu tapes : regedit

Vas jusqu'à la clé suivante:

HKEY_LOCAL_MACHINE>SOFTWARE> et cherche ceci:Windows AdControl dis moi si tu le trouve.

Modifié le 6 décembre 2005 par charles ingals

mazoupili · le 6 décembre 2005

j'ai édité mon précédent message!

J'aimerai que tu ouvre le registre émarrer / Exécuter puis tu tapes : regedit

Vas jusqu'à la clé suivante:

HKEY_LOCAL_MACHINE>SOFTWARE> et cherche ceci:Windows AdControl dis moi si tu le trouve.

Non introuvable

Non introuvable

Dans windows controlad il y a un fichier info.txt:

What is Window ControlAd?

---------------------

Window ControlAd is free ad delivery software which provides targeted advertising offers.

How did Window ControlAd get installed on your computer?

----------------------------------------------------

You downloaded Window ControlAd from a Website that is able to offer its content for free because

it shows the Window ControlAd ActiveX popup. The Wind Update program is installed only once the user

has agreed on it by clicking on “yes”. Through the ActiveX, the user can review the license terms

and privacy policy before installing the software. Each and every distributor is carefully reviewed

to make sure that their distribution techniques abide by a strict code of conduct.

If you do not remember having seen an ActiveX prompt, you might have downloaded Window ControlAd from a

popular free software product (screensavers, games, file sharing software, etc.). Users always will

have to opt-in before installing the Window ControlAd software.

Removal instructions:

---------------------

Window ControlAd supports many free software products through its advertising relevancy technology.

If you remove Window ControlAd from your system, certain free software that you installed may no longer

function properly and you may have to reinstall them from a backup.

If you are sure that you want to remove Window ControlAd from your computer just follow these two easy steps:

1) Click Start -> Control Panel -> Add/Remove Programs

2) Scroll to Window ControlAd and click Remove

End User License Agreement:

---------------------------

Please find an up to date copy of Wind Update’s End User License Agreement at

http://www.windupdates.com/license.html

Non introuvable

Dans windows controlad il y a un fichier info.txt:

What is Window ControlAd?

---------------------

Window ControlAd is free ad delivery software which provides targeted advertising offers.

How did Window ControlAd get installed on your computer?

----------------------------------------------------

You downloaded Window ControlAd from a Website that is able to offer its content for free because

it shows the Window ControlAd ActiveX popup. The Wind Update program is installed only once the user

has agreed on it by clicking on “yes”. Through the ActiveX, the user can review the license terms

and privacy policy before installing the software. Each and every distributor is carefully reviewed

to make sure that their distribution techniques abide by a strict code of conduct.

If you do not remember having seen an ActiveX prompt, you might have downloaded Window ControlAd from a

popular free software product (screensavers, games, file sharing software, etc.). Users always will

have to opt-in before installing the Window ControlAd software.

Removal instructions:

---------------------

Window ControlAd supports many free software products through its advertising relevancy technology.

If you remove Window ControlAd from your system, certain free software that you installed may no longer

function properly and you may have to reinstall them from a backup.

If you are sure that you want to remove Window ControlAd from your computer just follow these two easy steps:

1) Click Start -> Control Panel -> Add/Remove Programs

2) Scroll to Window ControlAd and click Remove

End User License Agreement:

---------------------------

Please find an up to date copy of Wind Update’s End User License Agreement at

http://www.windupdates.com/license.html

Voici mon nouveau rapport hijackthis:

Logfile of HijackThis v1.99.1

Scan saved at 00:51:20, on 07/12/2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton Internet Security\NISUM.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Norton Internet Security\NISSERV.EXE

C:\PROGRA~1\NORTON~1\navapw32.exe

C:\Program Files\Norton Internet Security\IAMAPP.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Norton Internet Security\SymProxySvc.exe

C:\Program Files\Norton Internet Security\ATRACK.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aliceadsl.fr/

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Barre &Magique - {01A7812B-59E8-4A4F-BFD6-EEE6D4CB6BA2} - C:\Program Files\Telecom Italia France\Barre Magique 1.05.08.22\Tiscali BBar.dll

O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe

O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [sSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [instantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe

O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?

O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab

O16 - DPF: {041816FE-7869-4B5F-9BE4-FFF3B7368727} (IsHere Class) - http://barremagique.aliceadsl.fr/download/BarreMagique.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE

O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Plug-n-Play SP2 Fix (sp2pnpfix) - Conexant - (no file)

O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

Thanos · le 7 décembre 2005

Bien! Passe par Installer /Désinstaller(Panneau de Configuration) et désinstalle le programme suivant,si tu le trouves:

-Windows AdControl

-Supprime les fichiers/dossiers incriminés:

-C:\PROGRAM FILES\Windows ControlAd

vide la corbeille.

Démarre Hijackthis"open the Misc Tools Section" =>Delete an NT Service" et entre le nom suivant:sp2pnpfix

Puis tu cliques sur "Back"=>"Do a system scan only" et tu coche ceci:

O23 - Service: Plug-n-Play SP2 Fix (sp2pnpfix) - Conexant - (no file)

-Exécute EasyCleaner Registre et Inutiles.Ne pas toucher à la fonction doublons. Supprime tout ce qu'il te propose.

poste un nouveau rapport Hijackthis(en mode normal) pour vérification.

mazoupili · le 7 décembre 2005

J'ai réalisé la procédure que tu m'as envoyé mais je n'ai pas réussi à supprimer sp2pnpfix

voici mon nouveau rapport:

Logfile of HijackThis v1.99.1

Scan saved at 01:33:00, on 07/12/2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\NORTON~1\navapw32.exe

C:\Program Files\Norton Internet Security\IAMAPP.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton Internet Security\NISUM.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Norton Internet Security\SymProxySvc.exe

C:\Program Files\Norton Internet Security\NISSERV.EXE

C:\Program Files\Norton Internet Security\ATRACK.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aliceadsl.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =