|
|
Auteur
|
Message
|
1
|
|
|
|
Bonjour,
je pense avoir un virus bien nocif sur mon pc. Déjà, il a réinitialisé Firefox et Thunderbird donc j'ai perdu toutes mes pages marquées et mes mails, j'ai du tout reconfigurer de la base. En plus, je trouve qu'internet est très très lent, que le pc est également lent, et j'ai des processus inconnus qui tournent en fond. S'il est possible de faire quelque chose aidez moi!! merci d'avance.
-->Message édité par atchman le 04/07/2008 19:00:18<--
|
|
|
|
|
Salut atchman
Télécharge Hijackthis V 2.02 sur le bureau :
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
- Double clique sur HJTInstall.exe sur le bureau
- Clique sur Install ensuite sur I Accept
- fermer toutes les fenêtres, HJT doit être exécuté seul (tout autre programme fermé).
- lancer HJT et clic sur Do a system scan and save a logfile
- une fenêtre Notepad s'ouvre : Ctrl-A pour sélectionner tout le texte, Ctrl-C pour le copier dans le presse papier.
- mettre le texte dans un post ci-dessous (Ctrl-V) pour analyse
@++
|
|
|
|
|
salut, merci de prendre en charge mon cas ^^
voila le rapport hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:55, on 2008-06-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\winudspm.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.emn.fr/proxy/eleve/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=kgb.emn.fr:443;http=fbi.emn.fr:3128;https=cia.emn.fr:3128
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [dc5702ad] rundll32.exe "C:\WINDOWS\system32\sbghvygc.dll",b
O4 - HKLM\..\Run: [BMdf643131] Rundll32.exe "C:\WINDOWS\system32\gesmmsxf.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{DC570202-0640-1036-0803-060605060021}] "C:\Program Files\Fichiers communs\{DC570202-0640-1036-0803-060605060021}\Update.exe" mc-110-12-0000272
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_s(...)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: Domain = nantarena
O17 - HKLM\System\CCS\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: NameServer = 172.16.1.10,193.54.77.78
O17 - HKLM\System\CS1\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: Domain = nantarena
O17 - HKLM\System\CS1\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: NameServer = 172.16.1.10,193.54.77.78
O21 - SSODL: bfrgnos - {2AFD0038-D792-432B-86B4-610B15D280CB} - (no file)
O21 - SSODL: afxlspw - {6074DC40-3E60-4B4C-BCDD-262EC4E808D6} - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 7752 bytes
en esperant que ça sera utile!
a+
|
|
|
|
|
Salut atchman
Télécharge SDFix par AndyManchesta sur le Bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clic sur SDFix.exe sur le bureau et clic sur Install , un dossier sera créer sur le bureau.
Redémarre ton PC en mode sans échec :
Au redémarrage de ton PC tapote sur la touche F8 ou F5 sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur.
Ouvre le dossier SDFix sur le bureau et double clique sur RunThis.bat, appuie sur Y pour lancer le nettoyage.
Il y aura redémarrage, quand Finished s’affichera appuie sur un touche pour terminer.
Poste le rapport qui se trouve dans le dossier SDFix sous le nom de Report.txt dans ta prochaine réponse avec un nouveau log Hijackthis.
@++
|
|
|
|
|
salut, comme tu l'as indiqué, j'ai suivi les instructions.
Un problème pendant l'éxecution de SDFix en mode sans echec, le fichier C:/$Mft était endommagé (selon la popup d'alerte qui est apparu une bonne vingtaine de fois au cours du process). J'ai eu droit à un scandisk au reboot. Néanmoins, le programme s'est exécuté complètement. Voila le rapport.txt:
SDFix: Version 1.198
Run by Cédric HERVET on 2008-06-30 at 00:25
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Restoring Default HomePage Value
Restoring Default Desktop Components Value
Rebooting
Checking Files :
Trojan Files Found:
C:\PF.EXE - Deleted
C:\PS.EXE - Deleted
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe - Deleted
C:\WINDOWS\frplprg.exe - Deleted
C:\WINDOWS\winudmr.exe - Deleted
C:\WINDOWS\winudspm.exe - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 01:05:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d07e7e]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d07e8b]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:d2a65a02
"s1"=dword:d1b54ac5
"s2"=dword:a83b4df7
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:b3,49,3c,01,05,53,20,a0,71,ee,f0,f2,9c,41,db,b7,cd,76,11,74,c0,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f9,26,4e,41,86,c2,6d,b1,09,b9,d8,fb,87,0d,dd,3c,cf,..
"khjeh"=hex:98,4e,86,8f,c3,e5,35,d7,55,94,c7,0d,06,21,11,4c,79,f6,31,84,6d,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:61,05,b1,08,dd,2b,5e,1c,d4,96,ae,cb,03,61,f2,35,1e,cf,67,46,48,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d07e7e]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d07e8b]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:b3,49,3c,01,05,53,20,a0,71,ee,f0,f2,9c,41,db,b7,cd,76,11,74,c0,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f9,26,4e,41,86,c2,6d,b1,09,b9,d8,fb,87,0d,dd,3c,cf,..
"khjeh"=hex:98,4e,86,8f,c3,e5,35,d7,55,94,c7,0d,06,21,11,4c,79,f6,31,84,6d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:61,05,b1,08,dd,2b,5e,1c,d4,96,ae,cb,03,61,f2,35,1e,cf,67,46,48,..
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120%"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Cyanide\\Loki\\Loki.exe"="C:\\Program Files\\Cyanide\\Loki\\Loki.exe:*:Enabled:Loki"
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"="C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe:*:Enabled:Soulstorm"
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"="C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe:*:Enabled:DarkCrusade"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\TmNationsForever\\TmForever.exe"="C:\\Program Files\\TmNationsForever\\TmForever.exe:*:Enabled:TmForever"
"C:\\Program Files\\Day of Defeat\\hl.exe"="C:\\Program Files\\Day of Defeat\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Monte Cristo\\Silverfall\\Silverfall.exe"="C:\\Program Files\\Monte Cristo\\Silverfall\\Silverfall.exe:*:Enabled:Silverfall"
"C:\\Program Files\\Reality Pump\\Earth 2160\\Earth2160_NO_SSE.exe"="C:\\Program Files\\Reality Pump\\Earth 2160\\Earth2160_NO_SSE.exe:*:Enabled:Earth 2160"
"C:\\Program Files\\Reality Pump\\Earth 2160\\Earth2160_SSE.exe"="C:\\Program Files\\Reality Pump\\Earth 2160\\Earth2160_SSE.exe:*:Enabled:Earth 2160"
"C:\\WINDOWS\\system32\\javaw.exe"="C:\\WINDOWS\\system32\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Program Files\\SWAT 4\\Content\\System\\Swat4.exe"="C:\\Program Files\\SWAT 4\\Content\\System\\Swat4.exe:*:Enabled:SWAT 4"
"C:\\Program Files\\SWAT 4\\ContentExpansion\\System\\Swat4X.exe"="C:\\Program Files\\SWAT 4\\ContentExpansion\\System\\Swat4X.exe:*:Enabled:SWAT 4 - The Stetchkov Syndicate"
"C:\\xampp\\apache\\bin\\apache.exe"="C:\\xampp\\apache\\bin\\apache.exe:*:Enabled:Apache HTTP Server"
"C:\\xampp\\MercuryMail\\mercury.exe"="C:\\xampp\\MercuryMail\\mercury.exe:*:Enabled:Mercury/32 Core Processing Module v4.52"
"C:\\xampp\\mysql\\bin\\mysqld.exe"="C:\\xampp\\mysql\\bin\\mysqld.exe:*:Enabled:mysqld"
"C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\Extensions\\DBG\\DbgListener.exe"="C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\Extensions\\DBG\\DbgListener.exe:*:Enabled:Listener for php debugger DBG"
"C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\PHPEdit.exe"="C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\PHPEdit.exe:*:Enabled:PHPEdit - The PHP IDE"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Wed 14 Nov 2007 48 ..SH. --- "C:\WINDOWS\S56A659C4.tmp"
Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Fri 18 May 2007 552,709 A.SH. --- "C:\WINDOWS\inf\sdndb.tmp"
Tue 17 Jul 2007 1,048,488 ..SH. --- "C:\WINDOWS\inf\sdndb.bak1"
Tue 17 Jul 2007 1,047,944 ..SH. --- "C:\WINDOWS\inf\sdndb.bak2"
Tue 17 Apr 2007 1,633,694 ..SH. --- "C:\WINDOWS\system32\jtrhtayj.tmp"
Thu 12 Oct 2006 431,078 A.SH. --- "C:\WINDOWS\system32\rrutv.tmp"
Thu 21 Dec 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 7 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 29 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ad213d081e2675ef87a62c73b8abf209\BIT7.tmp"
Mon 18 Dec 2006 652,541 A.SH. --- "C:\WINDOWS\system32\IME\PINTLGNT\cmflxm.tmp"
Mon 10 Dec 2007 4,521 ...HR --- "C:\Documents and Settings\C‚dric HERVET\Application Data\SecuROM\UserData\securom_v7_01.bak"
Finished!
et là le rapport hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:16, on 2008-06-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.emn.fr/proxy/eleve/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=kgb.emn.fr:443;http=fbi.emn.fr:3128;https=cia.emn.fr:3128
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [dc5702ad] rundll32.exe "C:\WINDOWS\system32\sbghvygc.dll",b
O4 - HKLM\..\Run: [BMdf643131] Rundll32.exe "C:\WINDOWS\system32\gesmmsxf.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_s(...)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: Domain = nantarena
O17 - HKLM\System\CCS\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: NameServer = 172.16.1.10,193.54.77.78
O17 - HKLM\System\CS1\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: Domain = nantarena
O17 - HKLM\System\CS1\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: NameServer = 172.16.1.10,193.54.77.78
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 7228 bytes
j'éspère que tout s'est bien passé!
a+
|
|
|
|
|
Salut atchman
Télécharge combofix.exe (de sUBs) sur le bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double clique combofix.exe tape 1 valide par Entrée pour lancer le scan
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Combofix est détecté par certains antivirus comme une infection, ne pas en tenir compte, il s'agit d'un faux positif
N'en tiens pas compte continue la procédure
@++
|
|
|
|
|
voila le rapport combofix:
ComboFix 08-06-20.4 - Cédric HERVET 2008-06-30 1:54:40.5 - NTFSx86
Endroit: C:\Documents and Settings\Cédric HERVET\Bureau\ComboFix.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BMdf643131.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cgyvhgbs.ini
C:\WINDOWS\system32\mcrh.tmp
.
---- Previous Run -------
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\BMdf643131.xml
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cgyvhgbs.ini
C:\WINDOWS\system32\efcYSjhE.dll
C:\WINDOWS\system32\etaslsew.dll
C:\WINDOWS\system32\ifnknvan.ini
C:\WINDOWS\system32\khfGvtsp.dll
C:\WINDOWS\system32\kuqteepk.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJbbAPj.dll
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nnnoLCrq.dll
C:\WINDOWS\system32\qoMFVOIx.dll
C:\WINDOWS\system32\rlmgeisu.ini
C:\WINDOWS\system32\urqOIawt.dll
C:\WINDOWS\system32\xIOVFMoq.ini
C:\WINDOWS\system32\xIOVFMoq.ini2
C:\WINDOWS\system32\XxGNoUtv.ini
C:\WINDOWS\system32\XxGNoUtv.ini2
C:\WINDOWS\system32\yifsxfik.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-28 to 2008-06-29 ))))))))))))))))))))))))))))))))))))
.
2008-06-30 00:17 . 2008-06-30 00:17 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-30 00:08 . 2008-06-30 01:15 <REP> d-------- C:\SDFix
2008-06-29 22:55 . 2008-06-29 22:55 <REP> d-------- C:\Program Files\Trend Micro
2008-06-24 17:42 . 2008-06-24 17:42 <REP> d-------- C:\Program Files\Lavasoft
2008-06-23 02:07 . 2008-06-27 02:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-23 02:07 . 2008-06-23 02:07 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-21 13:13 . 2008-06-20 13:36 39,075 --------- C:\WINDOWS\trz25.tmp
2008-06-20 13:47 . 2008-06-20 13:47 79,360 --a------ C:\WINDOWS\system32\sbghvygc.dll
2008-06-20 13:41 . 2008-06-20 13:41 90,112 --a------ C:\WINDOWS\system32\gesmmsxf.dll
2008-06-20 12:47 . 2008-06-20 12:47 <REP> d-------- C:\Program Files\Notepad++
2008-06-20 12:47 . 2008-06-20 12:48 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\Notepad++
2008-06-17 11:07 . 2008-06-27 21:27 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\SPORE Creature Creator
2008-06-16 16:46 . 2008-06-16 16:46 <REP> d-------- C:\WINDOWS\Applian FLV Player
2008-06-12 17:19 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-08 21:53 . 2003-03-15 23:15 90,112 --a------ C:\WINDOWS\unvise32.exe
2008-06-08 21:51 . 2008-06-08 22:12 <REP> d-------- C:\Program Files\MediaMobsters
2008-06-04 08:31 . 2008-06-04 08:32 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-02 19:16 . 2008-06-02 19:16 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\WaterProof
2008-06-02 19:15 . 2008-06-02 19:15 <REP> d-------- C:\Program Files\WaterProof
2008-06-02 13:18 . 2008-06-10 08:05 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-05-29 14:30 . 2008-06-21 12:43 402 --a------ C:\Documents
2008-05-29 08:45 . 2008-05-28 18:31 372,224 --------- C:\WINDOWS\system32\trz49.tmp
2008-05-29 08:45 . 2008-05-29 07:05 133,632 --------- C:\WINDOWS\system32\trz48.tmp
2008-05-29 08:45 . 2008-05-29 06:54 126,464 --------- C:\WINDOWS\system32\trz47.tmp
2008-05-29 08:45 . 2008-05-29 06:59 116,224 --------- C:\WINDOWS\system32\trz46.tmp
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-29 23:20 --------- d-----w C:\Program Files\mIRC
2008-06-29 20:49 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-28 14:15 --------- d-----w C:\Program Files\SWAT 4
2008-06-24 15:42 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-06-24 15:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-21 12:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-06-21 12:09 --------- d-----w C:\Program Files\AVSMedia
2008-06-19 08:00 --------- d-----w C:\Documents and Settings\Cédric HERVET\Application Data\gtk-2.0
2008-06-17 09:07 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-17 09:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-17 09:06 --------- d-----w C:\Program Files\Electronic Arts
2008-06-15 23:22 --------- d-----w C:\Program Files\DivX
2008-06-14 17:59 272,768 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-29 13:06 2,530 ----a-w C:\WINDOWS\system32\tmp.reg
2008-05-28 16:27 56,832 ----a-w C:\sxy1.com
2008-05-28 16:24 40,960 ----a-w C:\dci.exe
2008-05-28 16:21 56,832 ----a-w C:\sxy.com
2008-05-23 09:29 --------- d-----w C:\Documents and Settings\Cédric HERVET\Application Data\OpenOffice.org2
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-20 15:15 --------- d-----w C:\Program Files\THQ
2008-05-17 18:53 --------- d-----w C:\Program Files\Valve
2008-05-17 03:28 --------- d-----w C:\Documents and Settings\Cédric HERVET\Application Data\Sierra Entertainment
2008-05-17 03:26 --------- d-----w C:\Program Files\AGEIA Technologies
2008-05-17 03:07 --------- d-----w C:\Program Files\Nobilis
2008-05-17 01:04 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-16 14:25 --------- d-----w C:\Documents and Settings\Cédric HERVET\Application Data\Subversion
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-12 08:02 --------- d-----w C:\Program Files\Crimsonland
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 22:36 --------- d-----w C:\Program Files\ReflexiveArcade
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-04 17:08 --------- d-----w C:\Program Files\Monte Cristo
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-14 16:16 15,397 ----a-w C:\Program Files\settings.dat
2007-07-17 13:41 1,048,138 --sh--w C:\WINDOWS\inf\sdndb.ini2
2007-07-17 13:40 1,048,488 --sh--w C:\WINDOWS\inf\sdndb.bak1
2007-07-17 13:40 1,047,944 --sh--w C:\WINDOWS\inf\sdndb.bak2
2007-05-18 10:20 552,709 --sha-w C:\WINDOWS\inf\sdndb.tmp
2007-03-08 13:49 194 ----a-w C:\Documents and Settings\Cédric HERVET\Application Data\wklnhst.dat
2006-05-06 16:42 7,260,160 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll
2007-07-17 13:40 1,048,488 --sh--w C:\WINDOWS\inf\sdndb.bak1
2007-07-17 13:40 1,047,944 --sh--w C:\WINDOWS\inf\sdndb.bak2
2007-07-17 13:41 1,048,138 --sh--w C:\WINDOWS\inf\sdndb.ini2
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"nwiz"="nwiz.exe" [2006-05-03 19:21 1519616 C:\WINDOWS\system32\nwiz.exe]
"SMSERIAL"="sm56hlpr.exe" [2005-09-16 14:01 557056 C:\WINDOWS\sm56hlpr.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-08-25 16:25 737369]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 16:58 16264192 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-03 19:21 7405568]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-12-05 12:32 185896]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"dc5702ad"="C:\WINDOWS\system32\sbghvygc.dll" [2008-06-20 13:47 79360]
"BMdf643131"="C:\WINDOWS\system32\gesmmsxf.dll" [2008-06-20 13:41 90112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Agent Program Neighborhood.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Agent Program Neighborhood.lnk
backup=C:\WINDOWS\pss\Agent Program Neighborhood.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Monte Cristo\\Silverfall\\Silverfall.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\Extensions\\DBG\\DbgListener.exe"=
"C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\PHPEdit.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-01-22 14:06]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 01:58:48
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-06-30 2:06:04
ComboFix-quarantined-files.txt 2008-06-30 00:06:01
ComboFix2.txt 2008-02-19 13:08:26
Pre-Run: 6,718,590,976 octets libres
Post-Run: 6,708,883,456 octets libres
178 --- E O F --- 2008-06-25 00:57:45
|
|
|
|
|
Salut atchman
- Clique sur le menu démarrer/Exécuter, tape notepad à l’invite de commande et OK.
- Copie/colle ce qui est en citation ci-dessous dans le Bloc-Notes :
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dc5702ad"=-
"BMdf643131"=-
File::
C:\WINDOWS\trz25.tmp
C:\WINDOWS\system32\sbghvygc.dll
C:\WINDOWS\system32\gesmmsxf.dll
C:\WINDOWS\unvise32.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\trz49.tmp
C:\WINDOWS\system32\trz48.tmp
C:\WINDOWS\system32\trz47.tmp
C:\WINDOWS\system32\trz46.tmp
C:\sxy1.com
C:\dci.exe
C:\sxy.com
C:\WINDOWS\system32\lsdelete.exe
C:\WINDOWS\inf\sdndb.ini2
C:\WINDOWS\inf\sdndb.bak1
C:\WINDOWS\inf\sdndb.bak2
C:\WINDOWS\inf\sdndb.tmp
C:\WINDOWS\inf\sdndb.bak1
C:\WINDOWS\inf\sdndb.bak2
C:\WINDOWS\inf\sdndb.ini2
- Enregistre ce fichier sur le bureau (Impératif)
-Nom du fichier : CFScript.txt
-Type du fichier : tous les fichiers
- Clique sur Enregistrer et quitte le Bloc Notes
- Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe sur le bureau, comme sur cette capture :
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort), tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu avec un nouveau rapport Hijackthis.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
@++
|
|
|
|
|
le rapport combofix:
ComboFix 08-06-20.4 - Cédric HERVET 2008-06-30 2:49:40.6 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.589 [GMT 2:00]
Endroit: C:\Documents and Settings\Cédric HERVET\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Cédric HERVET\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
FILE ::
C:\dci.exe
C:\sxy.com
C:\sxy1.com
C:\WINDOWS\inf\sdndb.bak1
C:\WINDOWS\inf\sdndb.bak2
C:\WINDOWS\inf\sdndb.ini2
C:\WINDOWS\inf\sdndb.tmp
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\gesmmsxf.dll
C:\WINDOWS\system32\lsdelete.exe
C:\WINDOWS\system32\sbghvygc.dll
C:\WINDOWS\system32\trz46.tmp
C:\WINDOWS\system32\trz47.tmp
C:\WINDOWS\system32\trz48.tmp
C:\WINDOWS\system32\trz49.tmp
C:\WINDOWS\trz25.tmp
C:\WINDOWS\unvise32.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\dci.exe
C:\sxy.com
C:\sxy1.com
C:\WINDOWS\inf\sdndb.bak1
C:\WINDOWS\inf\sdndb.bak2
C:\WINDOWS\inf\sdndb.ini2
C:\WINDOWS\inf\sdndb.tmp
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\gesmmsxf.dll
C:\WINDOWS\system32\lsdelete.exe
C:\WINDOWS\system32\sbghvygc.dll
C:\WINDOWS\system32\trz46.tmp
C:\WINDOWS\system32\trz47.tmp
C:\WINDOWS\system32\trz48.tmp
C:\WINDOWS\system32\trz49.tmp
C:\WINDOWS\trz25.tmp
C:\WINDOWS\unvise32.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-28 to 2008-06-30 ))))))))))))))))))))))))))))))))))))
.
2008-06-30 00:17 . 2008-06-30 00:17 <REP> d-------- C:\WINDOWS\ERUNT
2008-06-30 00:08 . 2008-06-30 01:15 <REP> d-------- C:\SDFix
2008-06-29 22:55 . 2008-06-29 22:55 <REP> d-------- C:\Program Files\Trend Micro
2008-06-24 17:42 . 2008-06-24 17:42 <REP> d-------- C:\Program Files\Lavasoft
2008-06-23 02:07 . 2008-06-27 02:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-23 02:07 . 2008-06-23 02:07 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-20 12:47 . 2008-06-20 12:47 <REP> d-------- C:\Program Files\Notepad++
2008-06-20 12:47 . 2008-06-20 12:48 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\Notepad++
2008-06-17 11:07 . 2008-06-27 21:27 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\SPORE Creature Creator
2008-06-16 16:46 . 2008-06-16 16:46 <REP> d-------- C:\WINDOWS\Applian FLV Player
2008-06-12 17:19 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-08 21:51 . 2008-06-08 22:12 <REP> d-------- C:\Program Files\MediaMobsters
2008-06-02 19:16 . 2008-06-02 19:16 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\WaterProof
2008-06-02 19:15 . 2008-06-02 19:15 <REP> d-------- C:\Program Files\WaterProof
2008-06-02 13:18 . 2008-06-10 08:05 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-05-29 14:30 . 2008-06-21 12:43 402 --a------ C:\Documents
2008-05-28 17:01 . 2008-05-28 17:01 58 --a------ C:\WINDOWS\my.ini
2008-05-24 00:09 . 2003-08-08 15:05 290,816 --a------ C:\WINDOWS\system32\MatroskaSplitter.ax
2008-05-23 00:20 . 2008-05-23 00:20 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-23 00:20 . 2008-05-23 00:20 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-22 14:43 . 2008-05-22 14:44 <REP> d-------- C:\Documents and Settings\Cédric HERVET\MarsRoverViewer
2008-05-22 14:43 . 2008-05-22 14:44 <REP> d-------- C:\Documents and Settings\Cédric HERVET\MarsRoverViewer
2008-05-20 14:58 . 2008-06-19 10:00 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\gtk-2.0
2008-05-18 01:16 . 2008-05-18 01:16 <REP> d-------- C:\WINDOWS\SWAT 4
2008-05-18 01:16 . 2008-06-28 16:15 <REP> d-------- C:\Program Files\SWAT 4
2008-05-17 05:28 . 2008-05-17 05:28 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\Sierra Entertainment
2008-05-17 05:28 . 2008-05-17 05:28 <REP> d-------- C:\Documents and Settings\C
2008-05-17 05:25 . 2008-05-17 05:25 <REP> d-------- C:\WINDOWS\system32\AGEIA
2008-05-17 05:25 . 2008-06-24 17:42 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-05-17 05:25 . 2008-05-17 05:26 <REP> d-------- C:\Program Files\AGEIA Technologies
2008-05-17 05:07 . 2008-05-17 05:07 <REP> d-------- C:\Program Files\Nobilis
2008-05-17 04:04 . 2008-05-17 04:06 <REP> d-------- C:\REVOLT
2008-05-17 03:04 . 2008-05-17 03:04 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-16 16:25 . 2008-05-16 16:25 <REP> d-------- C:\Documents and Settings\Cédric HERVET\Application Data\Subversion
2008-05-16 16:17 . 2008-05-16 16:17 <REP> d-------- C:\Documents and Settings\Cédric HERVET\DocumentEditor
2008-05-16 16:17 . 2008-05-16 16:17 <REP> d-------- C:\Documents and Settings\Cédric HERVET\DocumentEditor
2008-05-16 16:15 . 2008-05-16 16:16 <REP> d-------- C:\Documents and Settings\Cédric HERVET\AnagramGame1
2008-05-16 16:15 . 2008-05-16 16:16 <REP> d-------- C:\Documents and Settings\Cédric HERVET\AnagramGame1
2008-05-16 16:15 . 2008-05-16 16:15 <REP> d-------- C:\Documents and Settings\Cédric HERVET\.netbeans-derby
2008-05-16 16:15 . 2008-05-16 16:15 <REP> d-------- C:\Documents and Settings\Cédric HERVET\.netbeans-derby
2008-05-16 14:40 . 2008-05-16 14:40 <REP> d-------- C:\Documents and Settings\Cédric HERVET\.netbeans-registration
2008-05-16 14:40 . 2008-05-16 14:40 <REP> d-------- C:\Documents and Settings\Cédric HERVET\.netbeans-registration
2008-05-16 14:38 . 2008-06-21 14:12 <REP> d-------- C:\Documents and Settings\Cédric HERVET\.nbi
2008-05-16 14:38 . 2008-06-21 14:12 <REP> d-------- C:\Documents and Settings\Cédric HERVET\.nbi
2008-05-16 14:27 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-05-16 14:27 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-05-16 14:27 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-05-08 00:36 . 2008-05-08 00:36 <REP> d-------- C:\Program Files\ReflexiveArcade
2008-05-08 00:36 . 2008-05-12 10:02 <REP> d-------- C:\Program Files\Crimsonland
2008-05-05 17:09 . 2008-05-05 19:04 <REP> d-------- C:\xpressmp
2008-05-01 16:33 . 2008-05-04 19:08 <REP> d-------- C:\Program Files\Monte Cristo
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 00:46 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-30 00:06 --------- d-----w C:\Program Files\mIRC
2008-06-24 15:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-21 12:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-06-21 12:09 --------- d-----w C:\Program Files\AVSMedia
2008-06-17 09:07 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-17 09:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-17 09:06 --------- d-----w C:\Program Files\Electronic Arts
2008-06-15 23:22 --------- d-----w C:\Program Files\DivX
2008-06-14 17:59 272,768 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-29 13:06 2,530 ----a-w C:\WINDOWS\system32\tmp.reg
2008-05-23 09:29 --------- d-----w C:\Documents and Settings\Cédric HERVET\Application Data\OpenOffice.org2
2008-05-20 15:15 --------- d-----w C:\Program Files\THQ
2008-05-17 18:53 --------- d-----w C:\Program Files\Valve
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-14 16:16 15,397 ----a-w C:\Program Files\settings.dat
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-05 14:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll
2008-03-05 14:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll
2008-03-05 14:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll
2008-03-05 13:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll
2008-03-05 13:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll
2008-03-01 22:12 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2007-03-08 13:49 194 ----a-w C:\Documents and Settings\Cédric HERVET\Application Data\wklnhst.dat
2006-05-06 16:42 7,260,160 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"nwiz"="nwiz.exe" [2006-05-03 19:21 1519616 C:\WINDOWS\system32\nwiz.exe]
"SMSERIAL"="sm56hlpr.exe" [2005-09-16 14:01 557056 C:\WINDOWS\sm56hlpr.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-08-25 16:25 737369]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 16:58 16264192 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-03 19:21 7405568]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-12-05 12:32 185896]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Agent Program Neighborhood.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Agent Program Neighborhood.lnk
backup=C:\WINDOWS\pss\Agent Program Neighborhood.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Monte Cristo\\Silverfall\\Silverfall.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\Extensions\\DBG\\DbgListener.exe"=
"C:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\PHPEdit.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-01-22 14:06]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 02:51:55
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-06-30 2:58:38
ComboFix-quarantined-files.txt 2008-06-30 00:58:06
ComboFix2.txt 2008-06-30 00:06:05
ComboFix3.txt 2008-02-19 13:08:26
Pre-Run: 6,695,665,664 octets libres
Post-Run: 6,682,656,768 octets libres
192 --- E O F --- 2008-06-25 00:57:45
et le rapport hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:59:25, on 30/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.emn.fr/proxy/eleve/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=kgb.emn.fr:443;http=fbi.emn.fr:3128;https=cia.emn.fr:3128
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_s(...)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: Domain = nantarena
O17 - HKLM\System\CCS\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: NameServer = 172.16.1.10,193.54.77.78
O17 - HKLM\System\CS1\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: Domain = nantarena
O17 - HKLM\System\CS1\Services\Tcpip\..\{0565EB9D-6230-4663-AB24-AD8A6C018012}: NameServer = 172.16.1.10,193.54.77.78
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 7080 bytes
voila!
|
|
|
|
|
Salut atchman
Ce dernier rapport est propre, on va vérifier si rien de caché :
Fais un scan en ligne ici http://webscanner.kaspersky.fr/ (A faire avec Internet Explorer)
- En bas à droite clique sur Démarrer Online-scanner dans la nouvelle fenêtre qui s'affiche clique sur J'accepte
- Accepte les Contrôle ActivX
- Choisis Poste de travail pour le scan. Celui-ci terminé clique sur Enregistrer rapport sous (Choisis fichier texte)
- Poste le rapport
- Pour t'aider à utiliser le scan en ligne http://www.malekal.com/scan_Av_en_ligne.html#mozTocId291566
- Si tu as un probléme pour l'installation du Contrôle ActivX lis ceci http://www.inoculer.com/activex.php3
@++
|
|
|
|
|
Salut!
J'ai suivi la procédure, mais je n'arrive pas à lancer le scan sur la machine. Kaspersky n'arrive pas à télécharger les bases de données de virus existants. Il faut dire que ma connection passe par un proxy qui n'accepte peut-être pas ce genre de choses...
Je n'ai rien trouvé dans les tuto qui règle le problème.
Qu'est-il possible de faire?
a+
|
|
|
|
|
Salut atchman
On va faire autrement, de toute façon je voulais en arriver là.
Je te conseille très vivement de désinstaller Avast! pour Antivir :
~ Avast! ne vous protège plus ? ~
L'utilitaire pour ça désinstallation :
http://www.avast.com/fre/avast-uninstall-utility.html
Tutoriel et téléchargement Antivir :
http://www.malekal.com/tutorial_antivir.php
Suivre le tutoriel et faire un scan en mode sans échec, sauvegarde le rapport et redémarre en mode normal et poste le rapport.
@++
|
|
|
|
|
|
salut, j'ai eu des problèmes de connexion récemment, et j'ai mis du temps à installer Antivir. Désolé du temps de réponse, je t'envoie le rapport d'antivir le plus vite possible!
|
|
|
|
|
hop! j'ai fait le scan Antivir en mode sans échec. J'ai mis tout ce qu'il a trouvé en quarantaine (mais j'ai l'impression que la plupart des fichiers détectés étaient en quarantaine par d'autres antivirus...). Désolé pour le temps de réponse. Voici le rapport:
Avira AntiVir Personal
Report file date: jeudi 3 juillet 2008 23:24
Scanning for 1376780 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Save mode
Username: Cédric HERVET
Computer name: ATCHMAN
Version information:
BUILD.DAT : 8.1.0.308 16478 Bytes 28/05/2008 17:03:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 21:20:36
ANTIVIR2.VDF : 7.0.5.20 142336 Bytes 30/06/2008 21:20:54
ANTIVIR3.VDF : 7.0.5.45 115712 Bytes 03/07/2008 21:16:49
Engineversion : 8.1.0.64
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.46 283002 Bytes 02/07/2008 21:17:14
AESCN.DLL : 8.1.0.22 119157 Bytes 30/06/2008 21:21:43
AERDL.DLL : 8.1.0.20 418165 Bytes 30/06/2008 21:21:40
AEPACK.DLL : 8.1.1.6 364918 Bytes 30/06/2008 21:21:35
AEOFFICE.DLL : 8.1.0.20 192891 Bytes 30/06/2008 21:21:31
AEHEUR.DLL : 8.1.0.35 1298806 Bytes 02/07/2008 21:17:11
AEHELP.DLL : 8.1.0.15 115063 Bytes 30/06/2008 21:21:17
AEGEN.DLL : 8.1.0.29 307573 Bytes 30/06/2008 21:21:14
AEEMU.DLL : 8.1.0.6 430451 Bytes 30/06/2008 21:21:08
AECORE.DLL : 8.1.0.32 168311 Bytes 02/07/2008 21:16:55
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: jeudi 3 juillet 2008 23:24
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '34' files ).
Starting the file scan:
Begin scan in 'C:\' <Atch Cave>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Program Files\a-squared Anti-Dialer\Quarantine\1FA651E1C1C230640EC651CB1347C00F.a2q
[0] Archive type: ZIP
--> WINDOWS/TEMP/idd8.tmp.exe
[1] Archive type: HIDDEN
--> MEM\AV0006e618.AV$
[DETECTION] Is the Trojan horse TR/Dialer.QN.179
[NOTE] The file was moved to '48aecb04.qua'!
C:\Program Files\a-squared Anti-Dialer\Quarantine\590CA0AFFBD27D6E00958E697B27CA9F.a2q
[0] Archive type: ZIP
--> WINDOWS/TEMP/idd2D2.tmp.exe
[1] Archive type: HIDDEN
--> MEM\AV0006e61a.AV$
[DETECTION] Is the Trojan horse TR/Dialer.QN.179
[NOTE] The file was moved to '489dcafd.qua'!
C:\Program Files\a-squared Anti-Dialer\Quarantine\8FC5D2B2887731D70F7F76EAEDBA0E5B.a2q
[0] Archive type: ZIP
--> WINDOWS/TEMP/idd2.tmp.exe
[1] Archive type: HIDDEN
--> MEM\AV0006e61c.AV$
[DETECTION] Is the Trojan horse TR/Dialer.QN.179
[NOTE] The file was moved to '48b0cb0d.qua'!
C:\Program Files\a-squared Anti-Dialer\Quarantine\F576CD423F1382ED39B20AB19A83F337.a2q
[0] Archive type: ZIP
--> WINDOWS/TEMP/idd43.tmp.exe
[1] Archive type: HIDDEN
--> MEM\AV0006e61e.AV$
[DETECTION] Is the Trojan horse TR/Dialer.QN.179
[NOTE] The file was moved to '48a4cafe.qua'!
C:\QooBox\Quarantine\C\dci.exe.vir
[DETECTION] Contains detection pattern of the worm WORM/IrcBot.353792
[NOTE] The file was moved to '48d6d5ad.qua'!
C:\QooBox\Quarantine\C\sxy.com.vir
[DETECTION] Contains detection pattern of the worm WORM/IrcBot.353792
[NOTE] The file was moved to '48e6d5c7.qua'!
C:\QooBox\Quarantine\C\sxy1.com.vir
[DETECTION] Contains detection pattern of the worm WORM/IrcBot.353792
[NOTE] The file was moved to '48e6d5c9.qua'!
C:\QooBox\Quarantine\C\WINDOWS\dwrmntsfwn.dll.vir
[DETECTION] Is the Trojan horse TR/Zlob.CEK
[NOTE] The file was moved to '48dfd5cb.qua'!
C:\QooBox\Quarantine\C\WINDOWS\edfqvrw.dll.vir
[DETECTION] Is the Trojan horse TR/Zlob.cek.1
[NOTE] The file was moved to '48d3d5bb.qua'!
C:\QooBox\Quarantine\C\WINDOWS\trz25.tmp.vir
[DETECTION] Is the Trojan horse TR/Spy.Agent.xaz
[NOTE] The file was moved to '48e7d5cb.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\efcYSjhE.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48d0d5c2.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\gesmmsxf.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.duj
[NOTE] The file was moved to '48e0d5c4.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\khfGvtsp.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.25600
[NOTE] The file was moved to '48d3d5ca.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\mlJbbAPj.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.25600
[NOTE] The file was moved to '48b7d5d0.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\nnnoLCrq.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.25600
[NOTE] The file was moved to '48dbd5d4.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\qoMFVOIx.dll.vir
[DETECTION] Is the Trojan horse TR/Monder.vaaa
[NOTE] The file was moved to '48bad5d8.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\sbghvygc.dll.vir
[DETECTION] Is the Trojan horse TR/Monder.YC
[NOTE] The file was moved to '48d4d5cd.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\trz47.tmp.vir
[DETECTION] Is the Trojan horse TR/Monder.126464.1
[NOTE] The file was moved to '48e7d5df.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\trz48.tmp.vir
[DETECTION] Is the Trojan horse TR/Monder.133632.1
[NOTE] The file was moved to '48e7d5e1.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\urqOIawt.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.25600
[NOTE] The file was moved to '48ded5e4.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\yifsxfik.exe.vir
[DETECTION] Is the Trojan horse TR/Lowzones.SG
[NOTE] The file was moved to '48d3d5df.qua'!
C:\SDFix\backups\backups.zip
[0] Archive type: ZIP
--> backups/frplprg.exe
[DETECTION] Is the Trojan horse TR/Zlob.cek.3
--> backups/ise32.exe
[DETECTION] Contains detection pattern of the worm WORM/IrcBot.353792
--> backups/pf.exe
[DETECTION] Is the Trojan horse TR/Agent.rht
--> backups/ps.exe
[DETECTION] Is the Trojan horse TR/Agent.rht
--> backups/winudmr.exe
[DETECTION] Is the Trojan horse TR/Agent.rht
--> backups/winudspm.exe
[DETECTION] Contains detection pattern of the worm WORM/IrcBot.353792
[NOTE] The file was moved to '48d0d65e.qua'!
C:\WINDOWS\trz5F.tmp
[DETECTION] Is the Trojan horse TR/Zlob.DBF
[NOTE] The file was moved to '48e7d6cb.qua'!
C:\WINDOWS\system32\drivers\dtscsi.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd7693.sys
[WARNING] The file could not be opened!
End of the scan: vendredi 4 juillet 2008 10:02
Used time: 10:37:16 min
The scan has been done completely.
27227 Scanning directories
1217827 Files were scanned
28 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
23 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
1217799 Files not concerned
11005 Archives were scanned
4 Warnings
23 Notes
|
|
|
|
|
Salut atchman
Faire un ménage des outils téléchargés, télécharge Tools Cleaner :
http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
- Clique sur Recherche et laisse le scan agir.
- Clique sur Suppression pour finaliser.
- Tu peux, si tu le souhaites, te servir des Options facultatives.
- Clique sur | | |
