[Virus] Problème Project1 et cmdservice

Salut,

Télécharge HijackThis:
Téléchargement de HijackThis

Installe le dans son propre dossier:
-clic droit sur le bureau, choisis "nouveau dossier" puis installe le dedans.
Lance le, clic sur "do a system scan and save logfile"
Puis copie et colle le rapport ici stp

Voilà c'est fait, par contre quand je lance Hijackthis, j'ai un msg d'erreur : "hijackthis a généré des erreurs et sera fermé par windows, vous devrez redémarrer le programme".

Je ne sais pas si j'ai donc tout le rapport de Hijackthis

Merci



C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Spamihilator\spamihilator.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Norton AntiVirus\OPScan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Documents and Settings\Nous\Bureau\Nouveau dossier\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Personal Firewall - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] DSLAGENT.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_15.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spamihilator] "C:\Spamihilator\spamihilator.exe"
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_sit...
O17 - HKLM\System\CCS\Services\Tcpip\..\{291271CB-302A-4827-94E9-6DDA2E447472}: NameServer = 80.10.246.1 80.10.246.132
O17 - HKLM\System\CS1\Services\Tcpip\..\{291271CB-302A-4827-94E9-6DDA2E447472}: NameServer = 80.10.246.1 80.10.246.132
O17 - HKLM\System\CS2\Services\Tcpip\..\{291271CB-302A-4827-94E9-6DDA2E447472}: NameServer = 80.10.246.1 80.10.246.132
O23 - Service: 16044 - Unknown owner - \\86.196.99.158\Admin$\eraseme_08700.exe (file missing)
O23 - Service: ADSLAutoconnect - Unknown owner - C:\ADSL Autoconnect\ADSL Autoconnect.exe" -z (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Norton Personal Firewall\ISSVC.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Microsoft Windows Spool Service (Windows Spool Service) - Unknown owner - C:\WINNT\wfdmgr.exe

fais une recherche de fichier et supprime ces fichiers:

kybrdff_15.exe
eraseme_08700.exe
wfdmgr.exe

**Si un fichier persiste lors de la suppression fais ceci:
-Redemarres ton pc, dès l'allumage de celui-ci tapote la touche f8, à l'écran qui va apparaitre choisis "mode sans echec" attends un peu.. puis vas supprimer les fichiers/dossiers qui persistaient, vides ta corbeille et redemarres normalement


Clic sur poste de travail, executer, tape: services.msc ,cherche et regle ces lignes sur "desactivé"


Microsoft Windows Spool Service
16044


Si tu n'as pas les logiciels anti-spywares ci-dessous telecharge les puis scan ton Pc completement:

SpyBot-Search & Destroy: (gratuit)
Spybot Search & Destroy

A² squared: (gratuit)
A² squared

Ad-Aware SE Personal: (en anglais, gratuit))
Ad-aware SE personal
-Le patch pour le faire fonctionner Ad-Aware SE en français: Patch français pour Ad-aware

Alors :

je n'ai pas trouvé les fichiers :
eraseme_08700.exe et wfdmgr.exe

Mais ... Je n'ai plus "project1" dans la barre des tâches : c'est déjà une bonne chose :-) merci

- Par contre en lançant Spybot, j'ai ce message après le scan :
2 problèmes n'ont pas pu être corrigés : (même en le relançant avec le démarrage de windows)
Command Service
->HKEY_LOCAL_MACHINE\SYSTEM\controlSet001\Services\cmdservice

-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlset\Services\cmdservice

- Et en lançant a-squared :

Trace.Registry.CasClient :
>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlset\Services\cmdservice

Trace.Registry.CommandService
>HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\Services\cmdservice\Enum->0
>HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\Services\cmdservice\Enum->Count
>HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\Services\cmdservice\Enum->NextInstance

ADWARE.WIN32.surfside.i
>c:\WINNT\temp\i770.tmp

Toujours pareil

Bonsoir,

Pour avancer Boulepate, que je salue au passage ;-)

Delcmdservice pour supprimer commandservice ou cmdservice (by Marckie)

http://users.telenet.be/marcvn/tools/delcmdservice.zip

Dezippe (décomprese) le fichier sur le bureau windows (création d’un dossier delcmdservice)
Doubleclic sur le dossier delcmdservice
Double clix sur delreg.bat pour lancer le fix
Quand le fix est terminé, rebooter l’ordi

Tiens nous au courant.

Bon courage.

A+

re,

Oups, excuses moi Amigo !

A+

bonjour,

voilà le rapport de kaspersky :


C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped

C:\Documents and Settings\Default User\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Default User\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\K9MN01WX\loader[1].exe Infected: Trojan-Downloader.Win32.VB.agk skipped

C:\Documents and Settings\Nous\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Application Data\Identities\{C0D184A3-E57B-4CAA-8D72-327D1CF5631A}\Microsoft\Outlook Express\Boîte de réception.dbx Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Application Data\Identities\{C0D184A3-E57B-4CAA-8D72-327D1CF5631A}\Microsoft\Outlook Express\cleanup.log Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Application Data\Identities\{C0D184A3-E57B-4CAA-8D72-327D1CF5631A}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Application Data\Identities\{C0D184A3-E57B-4CAA-8D72-327D1CF5631A}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Application Data\Identities\{C0D184A3-E57B-4CAA-8D72-327D1CF5631A}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Historique\History.IE5\MSHist012006090620060907\index.dat Object is locked skipped

C:\Documents and Settings\Nous\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Nous\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Nous\ntuser.dat.LOG Object is locked skipped

C:\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Norton AntiVirus\AVError.log Object is locked skipped

C:\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Norton AntiVirus\Quarantine\458C0BDA.tmp Infected: Trojan-Downloader.Win32.Small.cyh skipped

C:\Norton AntiVirus\Quarantine\5B463A85.exe Infected: Trojan-Downloader.Win32.Small.cyh skipped

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPPolicy.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPStart.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPStop.log Object is locked skipped

C:\Spamihilator\plugins\dccfilter\map Object is locked skipped

C:\Spamihilator\SPA1477.tmp.log Object is locked skipped

C:\Spamihilator\SPA1478.tmp.log Object is locked skipped

C:\WINNT\CSC\00000001 Object is locked skipped

C:\WINNT\Debug\ipsecpa.log Object is locked skipped

C:\WINNT\Debug\oakley.log Object is locked skipped

C:\WINNT\Debug\PASSWD.LOG Object is locked skipped

C:\WINNT\SchedLgU.Txt Object is locked skipped

C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINNT\Sti_Trace.log Object is locked skipped

C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped

C:\WINNT\system32\config\default Object is locked skipped

C:\WINNT\system32\config\default.LOG Object is locked skipped

C:\WINNT\system32\config\SAM Object is locked skipped

C:\WINNT\system32\config\SAM.LOG Object is locked skipped

C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped

C:\WINNT\system32\config\SECURITY Object is locked skipped

C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped

C:\WINNT\system32\config\software Object is locked skipped

C:\WINNT\system32\config\software.LOG Object is locked skipped

C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped

C:\WINNT\system32\config\system Object is locked skipped

C:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped

C:\WINNT\wfdmgr.exe Infected: Backdoor.Win32.SdBot.xd skipped

C:\WINNT\WindowsUpdate.log Object is locked skipped

Scan process completed.

je viens d'essayer le conseil d'incognito02et c'est toujours pareil