adware récurrent

Marsh Posté le 23-12-2004 à 16:26:00

bonjour,

régulièrement j'ai un navigateur qui se lance vers des adresse du style www.ad-w-a-r-e.... qui redirigent vers d'autres.

J'ai scanné avec ad-aware et un autre logiciel qui m'on viré tout un tas de conneri mais, le problème persiste et tout reviens régulièrement.
Je ne sais plus quoi faire.
voila le log de hijack

-----------------------------
Running Processes:
-----------------

#1: [smss.exe]
File Path: C:\WINDOWS\System32\smss.exe
ProcessID: 448
Priority: Normal
File Size: 44 KB
Version: 5.1.2600.1106
File Version: 5.1.2600.1106 (xpsp1.020828-1920)
Product Version: 5.1.2600.1106
Copyright: © Microsoft Corporation. All rights reserved.
Company Name: Microsoft Corporation
File Description: Windows NT Session Manager
Internal Name: smss.exe
Original Filename: smss.exe
Product Name: Microsoft® Windows® Operating System
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:18:46
Last modified: 30/08/2002 13:00:00

#2: [winlogon.exe]
File Path: C:\WINDOWS\system32\winlogon.exe
ProcessID: 528
Priority: High
File Size: 508 KB
Version: 5.1.2600.1106
File Version: 5.1.2600.1106 (xpsp1.020828-1920)
Product Version: 5.1.2600.1106
Copyright: © Microsoft Corporation. Tous droits réservés.
Company Name: Microsoft Corporation
File Description: Application d'ouverture de session Windows NT
Internal Name: winlogon
Original Filename: WINLOGON.EXE
Product Name: Système d'exploitation Microsoft® Windows®
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:22:41
Last modified: 30/08/2002 13:00:00

#3: [services.exe]
File Path: C:\WINDOWS\system32\services.exe
ProcessID: 580
Priority: Normal
File Size: 99 KB
Version: 5.1.2600.0
File Version: 5.1.2600.0 (xpclient.010817-1148)
Product Version: 5.1.2600.0
Copyright: © Microsoft Corporation. Tous droits réservés.
Company Name: Microsoft Corporation
File Description: Applications Services et Contrôleur
Internal Name: services.exe
Original Filename: services.exe
Product Name: Système d'exploitation Microsoft® Windows®
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:18:49
Last modified: 30/08/2002 13:00:00

#4: [lsass.exe]
File Path: C:\WINDOWS\system32\lsass.exe
ProcessID: 592
Priority: Normal
File Size: 11 KB
Version: 5.1.2600.1106
File Version: 5.1.2600.1106 (xpsp1.020828-1920)
Product Version: 5.1.2600.1106
Copyright: © Microsoft Corporation. All rights reserved.
Company Name: Microsoft Corporation
File Description: LSA Shell (Export Version)
Internal Name: lsass.exe
Original Filename: lsass.exe
Product Name: Microsoft® Windows® Operating System
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:19:06
Last modified: 30/08/2002 13:00:00

#5: [svchost.exe]
File Path: C:\WINDOWS\system32\svchost.exe
ProcessID: 760
Priority: Normal
File Size: 12 KB
Version: 5.1.2600.0
File Version: 5.1.2600.0 (xpclient.010817-1148)
Product Version: 5.1.2600.0
Copyright: © Microsoft Corporation. All rights reserved.
Company Name: Microsoft Corporation
File Description: Generic Host Process for Win32 Services
Internal Name: svchost.exe
Original Filename: svchost.exe
Product Name: Microsoft® Windows® Operating System
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:19:20
Last modified: 30/08/2002 13:00:00

#6: [svchost.exe]
File Path: C:\WINDOWS\System32\svchost.exe
ProcessID: 812
Priority: Normal
File Size: 12 KB
Version: 5.1.2600.0
File Version: 5.1.2600.0 (xpclient.010817-1148)
Product Version: 5.1.2600.0
Copyright: © Microsoft Corporation. All rights reserved.
Company Name: Microsoft Corporation
File Description: Generic Host Process for Win32 Services
Internal Name: svchost.exe
Original Filename: svchost.exe
Product Name: Microsoft® Windows® Operating System
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:23:17
Last modified: 30/08/2002 13:00:00

#7: [ccSetMgr.exe]
File Path: C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
ProcessID: 1052
Priority: Normal
File Size: 229 KB
Version: 2.1.3.4
File Version: 2.1.3.4
Product Version: 2.1.3.4
Copyright: Copyright (c) 2000-2003 Symantec Corporation. All rights reserved.
Company Name: Symantec Corporation
File Description: Common Client Settings Manager Service
Internal Name: ccSetMgr
Original Filename: ccSetMgr.exe
Product Name: Common Client
Created on: 20/12/2004 11:55:39
Last accessed: 23/12/2004 16:19:38
Last modified: 07/10/2004 09:01:26

#8: [ccEvtMgr.exe]
File Path: C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
ProcessID: 1072
Priority: Normal
File Size: 249 KB
Version: 2.1.3.4
File Version: 2.1.3.4
Product Version: 2.1.3.4
Copyright: Copyright (c) 2000-2003 Symantec Corporation. All rights reserved.
Company Name: Symantec Corporation
File Description: Common Client Event Manager Service
Internal Name: ccEvtMgr
Original Filename: ccEvtMgr.exe
Product Name: Common Client
Created on: 20/12/2004 11:55:39
Last accessed: 23/12/2004 16:19:39
Last modified: 07/10/2004 09:01:24

#9: [spoolsv.exe]
File Path: C:\WINDOWS\system32\spoolsv.exe
ProcessID: 1220
Priority: Normal
File Size: 50 KB
Version: 5.1.2600.0
File Version: 5.1.2600.0 (XPClient.010817-1148)
Product Version: 5.1.2600.0
Copyright: © Microsoft Corporation. All rights reserved.
Company Name: Microsoft Corporation
File Description: Spooler SubSystem App
Internal Name: spoolsv.exe
Original Filename: spoolsv.exe
Product Name: Microsoft® Windows® Operating System
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:19:38
Last modified: 30/08/2002 13:00:00

#10: [mdm.exe]
File Path: C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
ProcessID: 1396
Priority: Normal
File Size: 328 KB
Version: 7.10.3077.0
File Version: 7.10.3077
Product Version: 7.10.3077
Copyright: Copyright© Microsoft Corporation. All rights reserved.
Company Name: Microsoft Corporation
File Description: Machine Debug Manager
Internal Name: mdm.exe
Original Filename: mdm.exe
Product Name: Microsoft® Visual Studio .NET
Created on: 19/03/2003 10:55:54
Last accessed: 23/12/2004 16:19:03
Last modified: 19/03/2003 10:55:54

#11: [navapsvc.exe]
File Path: C:\Program Files\Norton AntiVirus\navapsvc.exe
ProcessID: 1424
Priority: Normal
File Size: 155 KB
Version: 10.0.14.2
File Version: 10.00.2
Product Version: 10.00.2
Copyright: Norton AntiVirus 2004 for Windows 98/ME/2000/XP Copyright (c) 2003 Symantec Corporation. All rights reserved.
Company Name: Symantec Corporation
File Description: Norton AntiVirus Auto-Protect Service
Internal Name: NAVAPSVC
Original Filename: NAVAPSVC.EXE
Product Name: Norton AntiVirus
Created on: 20/12/2004 13:54:06
Last accessed: 23/12/2004 16:22:42
Last modified: 12/05/2004 14:12:56

#12: [SAVScan.exe]
File Path: C:\Program Files\Norton AntiVirus\SAVScan.exe
ProcessID: 1708
Priority: Normal
File Size: 189 KB
Version: 9.2.1.14
File Version: 9.2.1.14
Product Version: 9.2
Copyright: Copyright (c) 2003 Symantec Corporation
Company Name: Symantec Corporation
File Description: Symantec AntiVirus Scanner
Internal Name: SAVSCAN
Original Filename: SAVSCAN.EXE
Product Name: Symantec AntiVirus AutoProtect
Created on: 20/12/2004 11:55:45
Last accessed: 23/12/2004 16:19:10
Last modified: 07/11/2003 17:46:00

#13: [Explorer.EXE]
File Path: C:\WINDOWS\Explorer.EXE
ProcessID: 536
Priority: Normal
File Size: 984 KB
Version: 6.0.2800.1106
File Version: 6.00.2800.1106 (xpsp1.020828-1920)
Product Version: 6.00.2800.1106
Copyright: © Microsoft Corporation. Tous droits réservés.
Company Name: Microsoft Corporation
File Description: Explorateur Windows
Internal Name: explorer
Original Filename: EXPLORER.EXE
Product Name: Système d'exploitation Microsoft® Windows®
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:19:32
Last modified: 30/08/2002 13:00:00

#14: [point32.exe]
File Path: C:\Program Files\Microsoft Hardware\Mouse\point32.exe
ProcessID: 956
Priority: Normal
File Size: 164 KB
Version: 4.0.657.1
File Version: 4.00.0657.1
Product Version: 4.0
Copyright: Copyright (C) Microsoft Corp. 1983-2001
Company Name: Microsoft Corporation
File Description: Microsoft IntelliPoint
Internal Name: POINT32
Original Filename: POINT32.EXE
Product Name: Microsoft IntelliPoint
Created on: 24/08/2001 02:37:39
Last accessed: 23/12/2004 16:19:31
Last modified: 24/08/2001 02:37:39

#15: [daemon.exe]
File Path: C:\Program Files\D-Tools\daemon.exe
ProcessID: 1016
Priority: Normal
File Size: 80 KB
Version: 3.46.0.0
File Version: 3.46.0.0
Product Version: 3.46.0.0
Copyright: Copyright (C) 2000-2004
Company Name: DAEMON'S HOME
File Description: Virtual DAEMON Manager
Internal Name: DAEMON.EXE
Original Filename: daemon.exe
Product Name: DAEMON Tools
Created on: 12/03/2004 21:43:18
Last accessed: 23/12/2004 16:19:44
Last modified: 12/03/2004 21:43:18

#16: [ccApp.exe]
File Path: C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
ProcessID: 1280
Priority: Normal
File Size: 69 KB
Version: 2.1.3.4
File Version: 2.1.3.4
Product Version: 2.1.3.4
Copyright: Copyright (c) 2000-2003 Symantec Corporation. All rights reserved.
Company Name: Symantec Corporation
File Description: Common Client User Session
Internal Name: ccApp
Original Filename: ccApp.exe
Product Name: Common Client
Created on: 20/12/2004 11:55:39
Last accessed: 23/12/2004 16:19:39
Last modified: 07/10/2004 09:01:24

#17: [WZQKPICK.EXE]
File Path: C:\Program Files\WinZip\WZQKPICK.EXE
ProcessID: 1476
Priority: Normal
File Size: 104 KB
Version: 1.0.0.0
File Version: 1.0 (32-bit)
Product Version: 8.1 (4319)
Copyright: Copyright (c) WinZip Computing, Inc. 1991-2001 - All Rights Reserved
Company Name: WinZip Computing, Inc.
File Description: WinZip Executable
Internal Name: WZQKPICK.EXE
Original Filename: WZQKPICK.EXE
Product Name: WinZip
Created on: 07/04/2003 11:00:07
Last accessed: 23/12/2004 16:19:44
Last modified: 27/11/2001 07:10:00

#18: [Flash.exe]
File Path: C:\Program Files\Macromedia\Flash MX 2004\Flash.exe
ProcessID: 1316
Priority: Normal
File Size: 12904 KB
Version: 7.2.0.581
File Version: 7, 2, 0, 581
Product Version: 7, 2, 0, 581
Copyright: Copyright 1993-2004 Macromedia, Inc.
Company Name: Macromedia, Inc.
File Description: Flash MX 2004
Internal Name: Flash
Original Filename: Flash.exe
Product Name: Macromedia Flash
Created on: 06/10/2004 13:29:15
Last accessed: 23/12/2004 16:19:48
Last modified: 09/07/2004 04:34:42

#19: [Macromedia Licensing.exe]
File Path: C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
ProcessID: 932
Priority: Normal
File Size: 68 KB
Version: 2.65.0.1
File Version: 2.65.000
Product Version:
Copyright:
Company Name: Macromedia
File Description: System Level Service Utility
Internal Name:
Original Filename:
Product Name: Macromedia Licensing Service
Created on: 06/10/2004 13:31:27
Last accessed: 23/12/2004 16:19:45
Last modified: 06/10/2004 13:31:27

#20: [rundll32.exe]
File Path: C:\WINDOWS\system32\rundll32.exe
ProcessID: 2440
Priority: Normal
File Size: 31 KB
Version: 5.1.2600.0
File Version: 5.1.2600.0 (xpclient.010817-1148)
Product Version: 5.1.2600.0
Copyright: © Microsoft Corporation. Tous droits réservés.
Company Name: Microsoft Corporation
File Description: Exécuter une DLL en tant qu'application
Internal Name: rundll
Original Filename: RUNDLL.EXE
Product Name: Système d'exploitation Microsoft® Windows®
Created on: 30/08/2002 13:00:00
Last accessed: 23/12/2004 16:20:53
Last modified: 30/08/2002 13:00:00

#21: [HiJack.exe]
File Path: C:\Program Files\BulletProofSoft.com\SpywareRemover\HS\HiJack.exe
ProcessID: 2744
Priority: Normal
File Size: 392 KB
Version: 2.0.0.0
File Version: 2, 0, 0, 0
Product Version: 2, 0, 0, 0
Copyright: Copyright (C) 2003
Company Name:
File Description: HiJack MFC Application
Internal Name: System Hijack Scanner
Original Filename: HiJack.EXE
Product Name: System Hijack Scanner
Created on: 26/04/2004 20:34:14
Last accessed: 23/12/2004 16:20:40
Last modified: 26/04/2004 20:34:14

#22: [msmsgs.exe]
File Path: C:\Program Files\Messenger\msmsgs.exe
ProcessID: 3696
Priority: Normal
File Size: 1456 KB
Version: 4.7.0.2009
File Version: 4.7.2009
Product Version: Version 4.7
Copyright: Copyright (c) Microsoft Corporation 1997-2003
Company Name: Microsoft Corporation
File Description: Messenger
Internal Name: msmsgs
Original Filename: msmsgs.exe
Product Name: Messenger
Created on: 14/04/2003 18:30:14
Last accessed: 23/12/2004 16:22:42
Last modified: 14/04/2003 18:30:14

System Hijack Scanner Entries:
---------------

R0 - HKCU\Software\Microsoft\Internet Explorer\Main, Start Page=about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main, Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main, Local Page=C:\WINDOWS\system32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar, LinksFolderName=Liens
R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Default_page_url=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Default_search_url=http://ie.search.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Default_search_url=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer, searchurl=http://ie.search.msn.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, proxyServer=ftp=192.168.0.1:21;gopher=192.168.0.1:6588;http=192.168.0.1:6588;https=192.168.0.1:6588;socks=192.168.0.1:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, proxyOverride=<local>
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - ToolBar: (no name) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - ToolBar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [POINTER] point32.exe (file missing)
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 (file missing)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - Global Start Up: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
O4 - Global Start Up: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
O4 - Global Start Up: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
O4 - Global User Start Up: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
O4 - Global User Start Up: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
O4 - Global User Start Up: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
O5 - HKCU\control panel\don't load: ncpa.cpl = No
O5 - HKCU\control panel\don't load: odbccp32.cpl = No
O8 - Extra Context Menu Items: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O12 - Plugin For .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://free.aol.com
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub [...] tor/sw.cab
O16 - DPF: {4CA2D7A3-82E2-4A41-957E-660280851ABC} (SamNet2004.SamActiveX) - http://perso.wanadoo.fr/site-tnt/E [...] winsam.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (JavaBeansBridge.Object) - http://java.sun.com/products/1.3/jinstall-11-win.cab
O17 - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TCPIP\Parameters, Domain=DOMAINE
O17 - HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TCPIP\Parameters, Domain=DOMAINE
O17 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Telephony, DomainName=DOMAINE
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll

--------------------------

merci pour votre aide

Reply

Marsh Posté le 23-12-2004 à 16:26:00

Reply

Marsh Posté le 23-12-2004 à 16:53:22

Essaye avec Norton, si tu l'a.
Avec moi, il m'a enlevé 3 logiciels publicitaire

Reply

Marsh Posté le 23-12-2004 à 16:56:21

Je suis en entreprise ya norton 2004 partout et les scan se lance 2 fois pas jour !

Reply

adware récurrent

Sujets relatifs:

Leave a Replay